gosuper 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 GoSuper
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,29 @@
+gosuper
+=======
+
+This package contains code adapted from the following open-source projects:
+
+vercel-labs/skills (https://github.com/vercel-labs/skills)
+  Licensed under MIT.
+  Adapted files in this package: src/agents.ts, src/source-parser.ts,
+  src/sanitize.ts, src/frontmatter.ts.
+
+  Copyright (c) Vercel, Inc.
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy
+  of this software and associated documentation files (the "Software"), to deal
+  in the Software without restriction, including without limitation the rights
+  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  copies of the Software, and to permit persons to whom the Software is
+  furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included in all
+  copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+  SOFTWARE.

package/README.md

@@ -0,0 +1,49 @@
+# gosuper
+
+The GoSuper bundle installer.
+
+```bash
+npx gosuper install <license-key>
+```
+
+Installs your purchased GoSuper bundle into every coding agent it detects on
+your machine (Claude Code, Cursor, Codex, OpenCode, Gemini CLI, …).
+
+## Commands
+
+| Command                       | Description                                         |
+| ----------------------------- | --------------------------------------------------- |
+| `gosuper install <key>`       | Install (or reinstall) the bundle bound to `<key>`. |
+| `gosuper update`              | Pull the latest published version.                  |
+| `gosuper list`                | List skills in your bundle.                         |
+| `gosuper info`                | Show license + bundle metadata.                     |
+| `gosuper status`              | Verify local copies match the server manifest.      |
+| `gosuper uninstall`           | Remove all bundle skills from every agent.          |
+| `gosuper help`                | Print this help.                                    |
+
+## Where things land
+
+| Agent        | Path                                   |
+| ------------ | -------------------------------------- |
+| Claude Code  | `~/.claude/skills/<bundle>-*`          |
+| Cursor       | `~/.cursor/skills/<bundle>-*`          |
+| Codex        | `~/.codex/skills/<bundle>-*`           |
+| OpenCode     | `~/.config/opencode/skills/<bundle>-*` |
+| Gemini CLI   | `~/.gemini/skills/<bundle>-*`          |
+| Universal    | `.agents/skills/<bundle>-*` (project)  |
+
+Lock file (license + installed agents): `~/.config/gosuper/lock.json`.
+
+## Env overrides
+
+| Variable             | Effect                                      |
+| -------------------- | ------------------------------------------- |
+| `GOSUPER_API_BASE`   | Override API base (default `gosuper.ai/api/v1`). |
+| `GOSUPER_CONFIG_DIR` | Override `~/.config/gosuper/`.              |
+| `GOSUPER_AGENTS`     | Comma-separated agent allowlist (default: auto-detect). |
+
+## Acknowledgements
+
+The agent registry, source parser, and SKILL.md frontmatter parser are adapted
+from [vercel-labs/skills](https://github.com/vercel-labs/skills) (MIT). See
+`NOTICE` for full attribution.

package/bin/cli.mjs

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { run } from '../dist/cli.js';
+
+run(process.argv.slice(2)).catch((err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
+});

package/dist/agents.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Agent registry.
+ *
+ * Adapted from vercel-labs/skills (MIT) — src/agents.ts.
+ * Trimmed to the agents GoSuper actively supports. Add more by extending
+ * the AgentType union in ./types.ts and adding a config entry below.
+ */
+import type { AgentConfig, AgentType } from './types.js';
+export declare const agents: Record<AgentType, AgentConfig>;
+/**
+ * Detect which agents appear to be installed on this machine.
+ * Always returns at least `universal` so `gosuper install` works on a fresh box.
+ */
+export declare function detectInstalledAgents(): AgentType[];
+export declare function parseAgentList(value: string | undefined): AgentType[] | null;

package/dist/agents.js

@@ -0,0 +1,85 @@
+/**
+ * Agent registry.
+ *
+ * Adapted from vercel-labs/skills (MIT) — src/agents.ts.
+ * Trimmed to the agents GoSuper actively supports. Add more by extending
+ * the AgentType union in ./types.ts and adding a config entry below.
+ */
+var _a, _b, _c;
+import { existsSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+const home = homedir();
+const xdgConfigHome = ((_a = process.env.XDG_CONFIG_HOME) === null || _a === void 0 ? void 0 : _a.trim()) || join(home, '.config');
+const claudeHome = ((_b = process.env.CLAUDE_CONFIG_DIR) === null || _b === void 0 ? void 0 : _b.trim()) || join(home, '.claude');
+const codexHome = ((_c = process.env.CODEX_HOME) === null || _c === void 0 ? void 0 : _c.trim()) || join(home, '.codex');
+export const agents = {
+    'claude-code': {
+        name: 'claude-code',
+        displayName: 'Claude Code',
+        projectSkillsDir: '.claude/skills',
+        globalSkillsDir: join(claudeHome, 'skills'),
+        detect: () => existsSync(claudeHome),
+    },
+    cursor: {
+        name: 'cursor',
+        displayName: 'Cursor',
+        projectSkillsDir: '.agents/skills',
+        globalSkillsDir: join(home, '.cursor/skills'),
+        detect: () => existsSync(join(home, '.cursor')),
+    },
+    codex: {
+        name: 'codex',
+        displayName: 'Codex',
+        projectSkillsDir: '.agents/skills',
+        globalSkillsDir: join(codexHome, 'skills'),
+        detect: () => existsSync(codexHome),
+    },
+    opencode: {
+        name: 'opencode',
+        displayName: 'OpenCode',
+        projectSkillsDir: '.agents/skills',
+        globalSkillsDir: join(xdgConfigHome, 'opencode', 'skills'),
+        detect: () => existsSync(join(xdgConfigHome, 'opencode')),
+    },
+    'gemini-cli': {
+        name: 'gemini-cli',
+        displayName: 'Gemini CLI',
+        projectSkillsDir: '.agents/skills',
+        globalSkillsDir: join(home, '.gemini/skills'),
+        detect: () => existsSync(join(home, '.gemini')),
+    },
+    universal: {
+        name: 'universal',
+        displayName: 'Universal (.agents/skills)',
+        projectSkillsDir: '.agents/skills',
+        globalSkillsDir: join(xdgConfigHome, 'agents', 'skills'),
+        detect: () => true,
+    },
+};
+/**
+ * Detect which agents appear to be installed on this machine.
+ * Always returns at least `universal` so `gosuper install` works on a fresh box.
+ */
+export function detectInstalledAgents() {
+    const detected = Object.keys(agents).filter((name) => name !== 'universal' && agents[name].detect());
+    if (detected.length === 0)
+        return ['universal'];
+    return detected;
+}
+export function parseAgentList(value) {
+    if (!value)
+        return null;
+    const requested = value
+        .split(',')
+        .map((s) => s.trim().toLowerCase())
+        .filter(Boolean);
+    const valid = [];
+    for (const name of requested) {
+        if (name in agents)
+            valid.push(name);
+        else
+            throw new Error(`Unknown agent: ${name}`);
+    }
+    return valid;
+}

package/dist/api.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Thin HTTP client for the GoSuper API.
+ */
+import type { InfoResponse, ManifestResponse, ResolveResponse } from './types.js';
+export declare function getApiBase(): string;
+export declare function assertKey(key: string): void;
+export declare function resolveBundle(key: string): Promise<ResolveResponse>;
+export declare function getInfo(key: string): Promise<InfoResponse>;
+export declare function getManifest(key: string): Promise<ManifestResponse>;
+export declare function postEvent(key: string, type: 'install' | 'update' | 'status' | 'list' | 'info' | 'uninstall' | 'error', meta?: Record<string, unknown>): Promise<void>;

package/dist/api.js

@@ -0,0 +1,63 @@
+/**
+ * Thin HTTP client for the GoSuper API.
+ */
+const KEY_REGEX = /^[a-zA-Z0-9_-]{16,64}$/;
+export function getApiBase() {
+    var _a, _b;
+    return ((_b = (_a = process.env.GOSUPER_API_BASE) === null || _a === void 0 ? void 0 : _a.trim().replace(/\/$/, '')) !== null && _b !== void 0 ? _b : 'https://gosuper.ai/api/v1');
+}
+export function assertKey(key) {
+    if (!KEY_REGEX.test(key)) {
+        throw new Error(`Invalid license key. Expected 16–64 chars of [a-zA-Z0-9_-], got ${key.length}.`);
+    }
+}
+async function getJson(path) {
+    const url = `${getApiBase()}${path}`;
+    const res = await fetch(url, {
+        headers: { Accept: 'application/json', 'User-Agent': 'gosuper-cli' },
+    });
+    if (!res.ok) {
+        let message = `${res.status} ${res.statusText}`;
+        try {
+            const body = (await res.json());
+            if (body === null || body === void 0 ? void 0 : body.error)
+                message = body.error;
+        }
+        catch (_a) {
+            /* ignore */
+        }
+        throw new Error(`API error: ${message}`);
+    }
+    return (await res.json());
+}
+export function resolveBundle(key) {
+    assertKey(key);
+    return getJson(`/resolve/${encodeURIComponent(key)}`);
+}
+export function getInfo(key) {
+    assertKey(key);
+    return getJson(`/info/${encodeURIComponent(key)}`);
+}
+export function getManifest(key) {
+    assertKey(key);
+    return getJson(`/manifest/${encodeURIComponent(key)}`);
+}
+export async function postEvent(key, type, meta = {}) {
+    // Best-effort — never throw. Telemetry must not block lifecycle commands.
+    if (!KEY_REGEX.test(key))
+        return;
+    try {
+        const url = `${getApiBase()}/install/${encodeURIComponent(key)}/event`;
+        await fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'User-Agent': 'gosuper-cli',
+            },
+            body: JSON.stringify({ type, meta }),
+        });
+    }
+    catch (_a) {
+        /* ignore */
+    }
+}

package/dist/cli.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Argv dispatcher for `npx gosuper`.
+ *
+ * Subcommands: install, info, list, status, update, uninstall, help, version.
+ * No external CLI framework — keeps zero runtime dependencies.
+ */
+export declare function run(argv: string[]): Promise<void>;

package/dist/cli.js

@@ -0,0 +1,113 @@
+/**
+ * Argv dispatcher for `npx gosuper`.
+ *
+ * Subcommands: install, info, list, status, update, uninstall, help, version.
+ * No external CLI framework — keeps zero runtime dependencies.
+ */
+import { runInfo, runInstall, runList, runStatus, runUninstall, runUpdate, } from './commands.js';
+import { fail } from './output.js';
+const VERSION = '0.1.0';
+const HELP = `gosuper · install and manage GoSuper skill bundles
+
+Usage:
+  gosuper install <license-key> [--agents <list>] [--project]
+  gosuper update    [--key <license>]
+  gosuper status    [--key <license>]
+  gosuper list      [--key <license>]
+  gosuper info      [--key <license>]
+  gosuper uninstall [--key <license>]
+  gosuper version
+  gosuper help
+
+Options:
+  --agents <list>   Comma-separated agent allowlist (default: auto-detect).
+                    Valid: claude-code, cursor, codex, opencode, gemini-cli, universal.
+  --project         Install to project (.agents/skills/) instead of user-home.
+  --key <license>   Target a specific license (only needed if you have several).
+
+Environment:
+  GOSUPER_API_BASE   Override API base URL (default: https://gosuper.ai/api/v1).
+  GOSUPER_AGENTS     Comma-separated agent allowlist (overridden by --agents).
+  GOSUPER_CONFIG_DIR Override ~/.config/gosuper/.
+
+Documentation: https://gosuper.ai
+Support:       hello@gosuper.ai
+`;
+function parseArgs(argv) {
+    const positional = [];
+    const flags = {};
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg.startsWith('--')) {
+            const name = arg.slice(2);
+            const next = argv[i + 1];
+            if (next !== undefined && !next.startsWith('--')) {
+                flags[name] = next;
+                i += 1;
+            }
+            else {
+                flags[name] = true;
+            }
+        }
+        else {
+            positional.push(arg);
+        }
+    }
+    return { positional, flags };
+}
+export async function run(argv) {
+    var _a;
+    const { positional, flags } = parseArgs(argv);
+    const command = (_a = positional[0]) !== null && _a !== void 0 ? _a : 'help';
+    if (flags.help === true || flags.h === true) {
+        console.log(HELP);
+        return;
+    }
+    switch (command) {
+        case 'install': {
+            const key = positional[1];
+            if (!key)
+                fail('Missing license key. Usage: gosuper install <license-key>');
+            await runInstall({
+                key: key,
+                agentsArg: typeof flags.agents === 'string' ? flags.agents : undefined,
+                global: flags.project !== true,
+            });
+            return;
+        }
+        case 'info':
+            await runInfo({ key: stringFlag(flags, 'key') });
+            return;
+        case 'list':
+            await runList({ key: stringFlag(flags, 'key') });
+            return;
+        case 'status':
+            await runStatus({ key: stringFlag(flags, 'key') });
+            return;
+        case 'update':
+            await runUpdate({ key: stringFlag(flags, 'key') });
+            return;
+        case 'uninstall':
+            await runUninstall({
+                key: stringFlag(flags, 'key'),
+                force: flags.force === true,
+            });
+            return;
+        case 'version':
+        case '--version':
+        case '-v':
+            console.log(`gosuper ${VERSION}`);
+            return;
+        case 'help':
+        case '--help':
+        case '-h':
+            console.log(HELP);
+            return;
+        default:
+            fail(`Unknown command: ${command}\n\n${HELP}`);
+    }
+}
+function stringFlag(flags, name) {
+    const v = flags[name];
+    return typeof v === 'string' ? v : undefined;
+}

package/dist/commands.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Lifecycle commands wired by cli.ts.
+ *
+ * Each command is independent; they share the lock file and the API client.
+ */
+export interface BaseOpts {
+    /** Optional license key. Defaults to the only license in lock.json, if any. */
+    key?: string;
+}
+export declare function runInstall(opts: {
+    key: string;
+    agentsArg?: string;
+    global?: boolean;
+}): Promise<void>;
+export declare function runInfo(opts: BaseOpts): Promise<void>;
+export declare function runList(opts: BaseOpts): Promise<void>;
+export declare function runStatus(opts: BaseOpts): Promise<void>;
+export declare function runUpdate(opts: BaseOpts): Promise<void>;
+export declare function runUninstall(opts: BaseOpts & {
+    force?: boolean;
+}): Promise<void>;

package/dist/commands.js

@@ -0,0 +1,172 @@
+/**
+ * Lifecycle commands wired by cli.ts.
+ *
+ * Each command is independent; they share the lock file and the API client.
+ */
+import { agents } from './agents.js';
+import { getInfo, getManifest, postEvent } from './api.js';
+import { install } from './install.js';
+import { getLicense, listLicenses, maskKey, removeLicense, upsertLicense, } from './lock.js';
+import { bold, dim, ok, say, warn } from './output.js';
+import { existsSync, readdirSync, rmSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+function pickKey(provided) {
+    if (provided)
+        return provided;
+    const licenses = listLicenses();
+    if (licenses.length === 0) {
+        throw new Error('No license found. Run `gosuper install <license-key>` first.');
+    }
+    if (licenses.length > 1) {
+        throw new Error(`Multiple licenses installed. Pass one explicitly:\n  ${licenses
+            .map((l) => `gosuper <command> --key ${maskKey(l.key)}`)
+            .join('\n  ')}`);
+    }
+    return licenses[0].key;
+}
+export async function runInstall(opts) {
+    await install({
+        key: opts.key,
+        agentsArg: opts.agentsArg,
+        global: opts.global,
+    });
+}
+export async function runInfo(opts) {
+    var _a, _b, _c, _d;
+    const key = pickKey(opts.key);
+    const info = await getInfo(key);
+    const local = getLicense(key);
+    console.log(bold(info.bundle_name));
+    if (info.bundle_description)
+        console.log(dim(info.bundle_description));
+    console.log('');
+    row('License', maskKey(key));
+    row('Customer', (_a = info.customer_name) !== null && _a !== void 0 ? _a : info.customer_email);
+    row('Status', info.status);
+    if (info.expires_at)
+        row('Expires', new Date(info.expires_at).toLocaleDateString());
+    row('Bundle', info.bundle_slug);
+    row('Server version', (_b = info.current_version) !== null && _b !== void 0 ? _b : '—');
+    row('Installed version', (_d = (_c = local === null || local === void 0 ? void 0 : local.installedVersion) !== null && _c !== void 0 ? _c : info.last_seen_version) !== null && _d !== void 0 ? _d : '—');
+    row('Install count', String(info.install_count));
+    if (local) {
+        row('Agents on this machine', local.agents.join(', '));
+    }
+    await postEvent(key, 'info');
+}
+export async function runList(opts) {
+    const key = pickKey(opts.key);
+    const manifest = await getManifest(key);
+    console.log(`${bold(manifest.bundle_name)} ${dim(`v${manifest.version} · ${manifest.skill_count} skills`)}`);
+    console.log('');
+    for (const skill of manifest.skills) {
+        const display = skill.slug.replace(`${manifest.bundle_slug}-`, '');
+        console.log(`  ${display}`);
+    }
+    await postEvent(key, 'list', { version: manifest.version });
+}
+export async function runStatus(opts) {
+    var _a;
+    const key = pickKey(opts.key);
+    const local = getLicense(key);
+    if (!local) {
+        throw new Error('Nothing installed locally. Run `gosuper install <key>`.');
+    }
+    const manifest = await getManifest(key);
+    const installedSlugs = new Set(manifest.skills.map((s) => s.slug));
+    let drift = 0;
+    for (const agentName of local.agents) {
+        const paths = (_a = local.paths[agentName]) !== null && _a !== void 0 ? _a : [];
+        let present = 0;
+        for (const p of paths) {
+            if (existsSync(p))
+                present += 1;
+            else
+                drift += 1;
+        }
+        const expected = paths.length;
+        const cfg = agents[agentName];
+        const flag = present === expected ? ok : warn;
+        flag(`${cfg.displayName.padEnd(28)} ${dim('→')} ${present}/${expected} skills present`);
+    }
+    if (local.installedVersion !== manifest.version) {
+        warn(`Local v${local.installedVersion} → server v${manifest.version}. Run \`gosuper update\`.`);
+    }
+    else if (drift === 0) {
+        ok(`In sync · v${manifest.version}`);
+    }
+    // Detect "extra" folders in any agent dir starting with our bundle prefix
+    // that aren't in the lock — useful when a customer manually copied files.
+    for (const agentName of local.agents) {
+        const root = agents[agentName].globalSkillsDir;
+        if (!existsSync(root))
+            continue;
+        for (const name of readdirSync(root)) {
+            if (!name.startsWith(`${local.bundleSlug}-`))
+                continue;
+            if (!installedSlugs.has(name)) {
+                warn(`Stale folder ${dim(join(root, name))} (no longer in bundle manifest)`);
+            }
+        }
+    }
+    await postEvent(key, 'status', {
+        version: manifest.version,
+        drift,
+    });
+}
+export async function runUpdate(opts) {
+    var _a;
+    const key = pickKey(opts.key);
+    const local = getLicense(key);
+    if (!local) {
+        throw new Error('Nothing installed locally. Run `gosuper install <key>`.');
+    }
+    const manifest = await getManifest(key);
+    if (manifest.version === local.installedVersion) {
+        ok(`Already on v${manifest.version}. Nothing to do.`);
+        return;
+    }
+    say(`Updating ${local.bundleSlug}: v${local.installedVersion} → v${manifest.version}`);
+    // Reuse the install pipeline. Same agents, same scope.
+    await install({
+        key,
+        agentsArg: local.agents.join(','),
+        global: true,
+    });
+    // Refresh updatedAt; install() already wrote a fresh entry.
+    upsertLicense(key, Object.assign(Object.assign({}, ((_a = getLicense(key)) !== null && _a !== void 0 ? _a : {
+        bundleSlug: local.bundleSlug,
+        installedVersion: manifest.version,
+        installedAt: local.installedAt,
+        updatedAt: new Date().toISOString(),
+        agents: local.agents,
+        paths: local.paths,
+    })), { updatedAt: new Date().toISOString() }));
+    await postEvent(key, 'update', {
+        from: local.installedVersion,
+        to: manifest.version,
+    });
+}
+export async function runUninstall(opts) {
+    var _a;
+    const key = pickKey(opts.key);
+    const local = getLicense(key);
+    if (!local) {
+        throw new Error('Nothing installed locally for that license.');
+    }
+    let removed = 0;
+    for (const agentName of local.agents) {
+        for (const path of (_a = local.paths[agentName]) !== null && _a !== void 0 ? _a : []) {
+            if (existsSync(path) && statSync(path).isDirectory()) {
+                rmSync(path, { recursive: true, force: true });
+                removed += 1;
+            }
+        }
+    }
+    removeLicense(key);
+    ok(`Removed ${removed} skill folder${removed === 1 ? '' : 's'} for ${local.bundleSlug}`);
+    await postEvent(key, 'uninstall', { removed });
+}
+function row(label, value) {
+    console.log(`  ${label.padEnd(22)} ${value}`);
+}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { run } from './cli.js';
+export { install } from './install.js';
+export { agents, detectInstalledAgents } from './agents.js';
+export type { AgentConfig, AgentType, InfoResponse, LicenseEntry, LockFile, ManifestResponse, ResolveResponse, } from './types.js';

package/dist/index.js

@@ -0,0 +1,3 @@
+export { run } from './cli.js';
+export { install } from './install.js';
+export { agents, detectInstalledAgents } from './agents.js';

package/dist/install.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Install pipeline:
+ *   1. Resolve license → tarball URL + sha256
+ *   2. Download tarball to a temp dir
+ *   3. Verify sha256
+ *   4. Extract via system `tar`
+ *   5. Materialize <bundle>-* skill folders into each detected agent's dir
+ *   6. Update lock.json + post 'install' event
+ */
+export interface InstallOptions {
+    /** License key (validated upstream). */
+    key: string;
+    /** Comma-separated agent allowlist; null/undefined = auto-detect. */
+    agentsArg?: string;
+    /** Install to user-home dirs (true) vs project dirs (false). Default true. */
+    global?: boolean;
+}
+export declare function install(opts: InstallOptions): Promise<void>;

package/dist/install.js

@@ -0,0 +1,136 @@
+/**
+ * Install pipeline:
+ *   1. Resolve license → tarball URL + sha256
+ *   2. Download tarball to a temp dir
+ *   3. Verify sha256
+ *   4. Extract via system `tar`
+ *   5. Materialize <bundle>-* skill folders into each detected agent's dir
+ *   6. Update lock.json + post 'install' event
+ */
+import { agents, detectInstalledAgents, parseAgentList } from './agents.js';
+import { postEvent, resolveBundle } from './api.js';
+import { maskKey, upsertLicense } from './lock.js';
+import { dim, ok, say } from './output.js';
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+export async function install(opts) {
+    var _a, _b;
+    const requested = parseAgentList((_a = opts.agentsArg) !== null && _a !== void 0 ? _a : process.env.GOSUPER_AGENTS);
+    const targetAgents = requested && requested.length > 0 ? requested : detectInstalledAgents();
+    const useGlobal = (_b = opts.global) !== null && _b !== void 0 ? _b : true;
+    say(`Resolving license ${dim(maskKey(opts.key))}…`);
+    const resolved = await resolveBundle(opts.key);
+    const { bundle, version } = resolved;
+    say(`${bundle.name} v${version.version} · ${version.skill_count} skills · ${formatBytes(version.byte_size)}`);
+    const tmpRoot = mkdtempSync(join(tmpdir(), 'gosuper-install-'));
+    const tarballPath = join(tmpRoot, `${bundle.slug}.tar.gz`);
+    const stagePath = join(tmpRoot, 'stage');
+    mkdirSync(stagePath, { recursive: true });
+    try {
+        say('Downloading bundle…');
+        await downloadTo(resolved.tarball_url, tarballPath);
+        say('Verifying checksum…');
+        const actual = sha256OfFile(tarballPath);
+        if (actual !== version.sha256) {
+            throw new Error(`Checksum mismatch.\n  expected ${version.sha256}\n  actual   ${actual}`);
+        }
+        say('Extracting…');
+        extractTar(tarballPath, stagePath);
+        const skillsRoot = join(stagePath, 'skills');
+        if (!existsSync(skillsRoot)) {
+            throw new Error('Tarball missing skills/ directory.');
+        }
+        const skillDirs = readdirSync(skillsRoot)
+            .filter((name) => name.startsWith(`${bundle.slug}-`))
+            .map((name) => ({ name, full: join(skillsRoot, name) }))
+            .filter((s) => statSync(s.full).isDirectory());
+        if (skillDirs.length === 0) {
+            throw new Error(`Tarball contained no skills with slug prefix "${bundle.slug}-".`);
+        }
+        const installedPaths = {};
+        for (const agentName of targetAgents) {
+            const cfg = agents[agentName];
+            const targetRoot = useGlobal
+                ? cfg.globalSkillsDir
+                : join(process.cwd(), cfg.projectSkillsDir);
+            mkdirSync(targetRoot, { recursive: true });
+            const agentPaths = [];
+            for (const skill of skillDirs) {
+                const dest = join(targetRoot, skill.name);
+                if (existsSync(dest))
+                    rmSync(dest, { recursive: true, force: true });
+                cpSync(skill.full, dest, { recursive: true });
+                agentPaths.push(dest);
+            }
+            installedPaths[agentName] = agentPaths;
+            ok(`${cfg.displayName.padEnd(28)} ${dim('→')} ${shortenHome(targetRoot)} (${skillDirs.length})`);
+        }
+        const now = new Date().toISOString();
+        upsertLicense(opts.key, {
+            bundleSlug: bundle.slug,
+            installedVersion: version.version,
+            installedAt: now,
+            updatedAt: now,
+            agents: targetAgents,
+            paths: installedPaths,
+        });
+        await postEvent(opts.key, 'install', {
+            version: version.version,
+            installed: skillDirs.length,
+            agents: targetAgents,
+            via: 'cli',
+        });
+        console.log('');
+        ok(`Installed ${bundle.name} v${version.version} · ${skillDirs.length} skills across ${targetAgents.length} agents`);
+        console.log('');
+        console.log('Next steps:');
+        console.log('  1. Restart your coding agent so it picks up the new skills');
+        console.log(`  2. Run ${dim('gosuper info')} to inspect your license`);
+        console.log(`  3. Run ${dim('gosuper update')} any time to pull a newer version`);
+    }
+    finally {
+        rmSync(tmpRoot, { recursive: true, force: true });
+    }
+}
+async function downloadTo(url, dest) {
+    const res = await fetch(url);
+    if (!res.ok || !res.body) {
+        throw new Error(`Download failed: ${res.status} ${res.statusText}`);
+    }
+    // res.body is a Web ReadableStream; convert to Node stream.
+    const nodeStream = Readable.fromWeb(res.body);
+    await pipeline(nodeStream, createWriteStream(dest));
+}
+function sha256OfFile(path) {
+    const buf = readFileSync(path);
+    return createHash('sha256').update(buf).digest('hex');
+}
+function extractTar(tarballPath, destDir) {
+    var _a, _b;
+    const result = spawnSync('tar', ['-xzf', tarballPath, '-C', destDir], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    if (result.status !== 0) {
+        const stderr = (_b = (_a = result.stderr) === null || _a === void 0 ? void 0 : _a.toString()) !== null && _b !== void 0 ? _b : '';
+        throw new Error(`tar -xzf failed: ${stderr.trim() || 'unknown error'}`);
+    }
+}
+function formatBytes(n) {
+    if (n < 1024)
+        return `${n} B`;
+    if (n < 1024 * 1024)
+        return `${(n / 1024).toFixed(1)} KB`;
+    return `${(n / (1024 * 1024)).toFixed(1)} MB`;
+}
+function shortenHome(p) {
+    var _a;
+    const home = (_a = process.env.HOME) !== null && _a !== void 0 ? _a : '';
+    if (home && p.startsWith(home))
+        return p.replace(home, '~');
+    return p;
+}

package/dist/lock.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Local lock file at ~/.config/gosuper/lock.json.
+ *
+ * Tracks every license that has installed a bundle on this machine, plus the
+ * skill folder paths owned by each license per agent. Used by:
+ *   - `gosuper info`     → list installed licenses
+ *   - `gosuper update`   → know which agents to refresh
+ *   - `gosuper uninstall` → know which folders to remove (safer than wildcard)
+ *
+ * Format adapted from vercel-labs/skills' skill-lock.ts (MIT). See NOTICE.
+ */
+import type { AgentType, LicenseEntry, LockFile } from './types.js';
+export declare function getConfigDir(): string;
+export declare function getLockPath(): string;
+export declare function readLock(): LockFile;
+export declare function writeLock(lock: LockFile): void;
+export declare function upsertLicense(key: string, entry: LicenseEntry): void;
+export declare function removeLicense(key: string): LicenseEntry | null;
+export declare function getLicense(key: string): LicenseEntry | null;
+export declare function listLicenses(): Array<{
+    key: string;
+    entry: LicenseEntry;
+}>;
+export declare function maskKey(key: string): string;
+export type { AgentType };

package/dist/lock.js

@@ -0,0 +1,79 @@
+/**
+ * Local lock file at ~/.config/gosuper/lock.json.
+ *
+ * Tracks every license that has installed a bundle on this machine, plus the
+ * skill folder paths owned by each license per agent. Used by:
+ *   - `gosuper info`     → list installed licenses
+ *   - `gosuper update`   → know which agents to refresh
+ *   - `gosuper uninstall` → know which folders to remove (safer than wildcard)
+ *
+ * Format adapted from vercel-labs/skills' skill-lock.ts (MIT). See NOTICE.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+const CURRENT_VERSION = 1;
+export function getConfigDir() {
+    var _a;
+    return (((_a = process.env.GOSUPER_CONFIG_DIR) === null || _a === void 0 ? void 0 : _a.trim()) ||
+        join(homedir(), '.config', 'gosuper'));
+}
+export function getLockPath() {
+    return join(getConfigDir(), 'lock.json');
+}
+export function readLock() {
+    var _a;
+    const path = getLockPath();
+    if (!existsSync(path)) {
+        return { version: CURRENT_VERSION, licenses: {} };
+    }
+    try {
+        const raw = readFileSync(path, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed.version !== CURRENT_VERSION) {
+            // On schema bumps, start fresh rather than partially migrate.
+            return { version: CURRENT_VERSION, licenses: {} };
+        }
+        return {
+            version: CURRENT_VERSION,
+            licenses: (_a = parsed.licenses) !== null && _a !== void 0 ? _a : {},
+        };
+    }
+    catch (_b) {
+        return { version: CURRENT_VERSION, licenses: {} };
+    }
+}
+export function writeLock(lock) {
+    const path = getLockPath();
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(lock, null, 2) + '\n', { mode: 0o600 });
+}
+export function upsertLicense(key, entry) {
+    var _a;
+    const lock = readLock();
+    const existing = lock.licenses[key];
+    lock.licenses[key] = Object.assign(Object.assign({}, entry), { installedAt: (_a = existing === null || existing === void 0 ? void 0 : existing.installedAt) !== null && _a !== void 0 ? _a : entry.installedAt, updatedAt: entry.updatedAt });
+    writeLock(lock);
+}
+export function removeLicense(key) {
+    const lock = readLock();
+    const entry = lock.licenses[key];
+    if (!entry)
+        return null;
+    delete lock.licenses[key];
+    writeLock(lock);
+    return entry;
+}
+export function getLicense(key) {
+    var _a;
+    return (_a = readLock().licenses[key]) !== null && _a !== void 0 ? _a : null;
+}
+export function listLicenses() {
+    const lock = readLock();
+    return Object.entries(lock.licenses).map(([key, entry]) => ({ key, entry }));
+}
+export function maskKey(key) {
+    if (key.length <= 8)
+        return '****';
+    return `${key.slice(0, 4)}…${key.slice(-4)}`;
+}

package/dist/output.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Tiny ANSI helpers — no dependency on picocolors/chalk to keep install size minimal.
+ */
+export declare const cyan: (s: string) => string;
+export declare const green: (s: string) => string;
+export declare const yellow: (s: string) => string;
+export declare const red: (s: string) => string;
+export declare const dim: (s: string) => string;
+export declare const bold: (s: string) => string;
+export declare const say: (msg: string) => void;
+export declare const ok: (msg: string) => void;
+export declare const warn: (msg: string) => void;
+export declare const fail: (msg: string) => never;

package/dist/output.js

@@ -0,0 +1,18 @@
+/**
+ * Tiny ANSI helpers — no dependency on picocolors/chalk to keep install size minimal.
+ */
+const isTty = process.stdout.isTTY === true;
+const color = (code, msg) => isTty ? `\x1b[${code}m${msg}\x1b[0m` : msg;
+export const cyan = (s) => color('36', s);
+export const green = (s) => color('32', s);
+export const yellow = (s) => color('33', s);
+export const red = (s) => color('31', s);
+export const dim = (s) => color('2', s);
+export const bold = (s) => color('1', s);
+export const say = (msg) => console.log(`${cyan('▸')} ${msg}`);
+export const ok = (msg) => console.log(`${green('✓')} ${msg}`);
+export const warn = (msg) => console.log(`${yellow('!')} ${msg}`);
+export const fail = (msg) => {
+    console.error(`${red('✗')} ${msg}`);
+    process.exit(1);
+};

package/dist/types.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Shared types for the gosuper CLI.
+ *
+ * AgentType + AgentConfig are adapted from vercel-labs/skills (MIT). See NOTICE.
+ */
+export type AgentType = 'claude-code' | 'cursor' | 'codex' | 'opencode' | 'gemini-cli' | 'universal';
+export interface AgentConfig {
+    /** Stable id used on the CLI (`-a claude-code`). */
+    name: AgentType;
+    /** Human label for prompts and logs. */
+    displayName: string;
+    /** Project-level skills directory (relative to cwd). */
+    projectSkillsDir: string;
+    /** Global (user-home) skills directory. Absolute path. */
+    globalSkillsDir: string;
+    /** Heuristic: does this agent appear to be installed on the machine? */
+    detect(): boolean;
+}
+export interface ResolveResponse {
+    license: {
+        customer_name: string | null;
+        status: 'active' | 'revoked' | 'expired';
+        expires_at: string | null;
+    };
+    bundle: {
+        slug: string;
+        name: string;
+        description: string | null;
+    };
+    version: {
+        version: string;
+        sha256: string;
+        byte_size: number;
+        skill_count: number;
+        changelog: string | null;
+    };
+    tarball_url: string;
+    tarball_ttl_seconds: number;
+}
+export interface InfoResponse {
+    customer_name: string | null;
+    customer_email: string;
+    bundle_slug: string;
+    bundle_name: string;
+    bundle_description: string | null;
+    current_version: string | null;
+    last_seen_version: string | null;
+    status: 'active' | 'revoked' | 'expired';
+    expires_at: string | null;
+    install_count: number;
+    last_installed_at: string | null;
+}
+export interface ManifestResponse {
+    bundle_slug: string;
+    bundle_name: string;
+    version: string;
+    sha256: string;
+    byte_size: number;
+    skill_count: number;
+    changelog: string | null;
+    skills: Array<{
+        slug: string;
+        sha256?: string;
+    }>;
+}
+export interface LockFile {
+    /** Schema version. Bump when shape changes. */
+    version: 1;
+    /** Per-license install record. */
+    licenses: Record<string, LicenseEntry>;
+}
+export interface LicenseEntry {
+    bundleSlug: string;
+    installedVersion: string;
+    installedAt: string;
+    updatedAt: string;
+    /** Agent ids that have a copy of this bundle on disk. */
+    agents: AgentType[];
+    /** Map of agent → list of skill folder paths owned by this license. */
+    paths: Partial<Record<AgentType, string[]>>;
+}

package/dist/types.js

@@ -0,0 +1,6 @@
+/**
+ * Shared types for the gosuper CLI.
+ *
+ * AgentType + AgentConfig are adapted from vercel-labs/skills (MIT). See NOTICE.
+ */
+export {};

package/package.json

@@ -0,0 +1,76 @@
+{
+  "name": "gosuper",
+  "version": "0.1.0",
+  "description": "Install and manage GoSuper skill bundles across Claude Code, Cursor, Codex, OpenCode, Gemini CLI, and more.",
+  "keywords": [
+    "agent-skills",
+    "ai-agents",
+    "claude-code",
+    "cli",
+    "codex",
+    "cursor",
+    "gemini-cli",
+    "gosuper",
+    "installer",
+    "opencode",
+    "skills"
+  ],
+  "homepage": "https://gosuper.ai",
+  "bugs": {
+    "url": "https://github.com/aksoneng/gosuper/issues",
+    "email": "hello@gosuper.ai"
+  },
+  "license": "MIT",
+  "author": {
+    "name": "GoSuper",
+    "email": "hello@gosuper.ai",
+    "url": "https://gosuper.ai"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aksoneng/gosuper.git",
+    "directory": "packages/cli"
+  },
+  "bin": {
+    "gosuper": "./bin/cli.mjs"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "LICENSE",
+    "NOTICE",
+    "README.md"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "clean": "git clean -xdf .turbo dist node_modules",
+    "dev": "node --import tsx/esm src/cli.ts",
+    "prepublishOnly": "pnpm run build",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@kit/tsconfig": "workspace:*",
+    "@types/node": "catalog:",
+    "tsx": "^4.19.0",
+    "typescript": "catalog:",
+    "vitest": "catalog:"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}