hngr 0.1.0 → 0.2.0

package/dist/skills-DwoDzsXd.mjs

@@ -0,0 +1,871 @@
+import { S as HngrError, g as resolveConnection, r as apiRequest, y as writeDirectoryAtomically } from "./http-2HWxLIOq.mjs";
+import { _ as resolveCapabilityVersion, a as failedResult, c as stringValues, d as homeDir, f as downloadContent, g as resolveCapability, h as parseCapabilityPath, i as errorBody, l as AGENTS, m as SKILL_KIND, n as readPublishFlags, o as positionalPaths, r as runPublish, s as runBatch, t as explicitName } from "./publish-D7zaQl9x.mjs";
+import { lstat, mkdir, readFile, readdir, rename, rm, symlink, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { randomUUID } from "node:crypto";
+import { deflateRawSync, inflateRawSync } from "node:zlib";
+// src/http-multipart.ts
+function isFile(part) {
+	return "data" in part;
+}
+function escapeQuoted(value) {
+	return value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"");
+}
+/**
+* Encodes an RFC 7578 form body in memory. Part order is preserved, which the
+* server relies on: the package (or config) must be the last part so it can be
+* consumed as a stream.
+*/
+function encodeMultipart(parts) {
+	const boundary = `----hngr-${randomUUID()}`;
+	const chunks = [];
+	for (const part of parts) {
+		chunks.push(Buffer.from(`--${boundary}\r\n`));
+		if (isFile(part)) chunks.push(Buffer.from(`Content-Disposition: form-data; name="${escapeQuoted(part.name)}"; filename="${escapeQuoted(part.filename)}"\r\nContent-Type: ${part.contentType}\r\n\r\n`), part.data);
+		else chunks.push(Buffer.from(`Content-Disposition: form-data; name="${escapeQuoted(part.name)}"\r\n\r\n${part.value}`, "utf8"));
+		chunks.push(Buffer.from("\r\n"));
+	}
+	chunks.push(Buffer.from(`--${boundary}--\r\n`));
+	return {
+		body: Buffer.concat(chunks),
+		contentType: `multipart/form-data; boundary=${boundary}`
+	};
+}
+/**
+* POSTs a multipart body through the shared request path, so Bearer injection,
+* cancellation and the problem+json error mapping are identical to JSON calls.
+*/
+async function postMultipart(connection, path, parts, headers = {}, signal) {
+	const { body, contentType } = encodeMultipart(parts);
+	return apiRequest(connection, {
+		method: "POST",
+		path,
+		rawBody: body,
+		headers: {
+			...headers,
+			"Content-Type": contentType
+		},
+		signal
+	});
+}
+// src/skills/agents.ts
+const AGENT_TARGETS = AGENTS.map((agent) => ({
+	id: agent.id,
+	projectSkillsDir: agent.skills.projectDir,
+	globalSkillsDir: agent.skills.globalDir,
+	link: agent.skills.link
+}));
+function findAgent(id) {
+	return AGENT_TARGETS.find((agent) => agent.id === id);
+}
+function agentIds() {
+	return AGENT_TARGETS.map((agent) => agent.id);
+}
+/** The canonical store for this scope. */
+function canonicalSkillsDir(cwd, env, global) {
+	return global ? join(homeDir(env), ".agents", "skills") : join(cwd, ".agents", "skills");
+}
+/** The directory an agent reads, or null when it shares the canonical store. */
+function agentSkillsDir(agent, cwd, env, global) {
+	if (global) return agent.globalSkillsDir?.(env) ?? null;
+	return agent.projectSkillsDir ? join(cwd, agent.projectSkillsDir) : null;
+}
+/**
+* The directory an agent actually reads: its own skills directory, or the
+* canonical store for universal agents. (`--copy` writes here; detection
+* checks the parent.)
+*/
+function targetSkillsDir(agent, cwd, env, global) {
+	return agentSkillsDir(agent, cwd, env, global) ?? canonicalSkillsDir(cwd, env, global);
+}
+/** Directory names that would collide with agent-owned skill stores. */
+const RESERVED_DIR_NAMES = ["synced", "anthropic-skills"];
+function isReservedDirName(name) {
+	return RESERVED_DIR_NAMES.includes(name.toLowerCase());
+}
+// src/skills/download.ts
+/** Downloads a Skill Package as `application/zip`. */
+function downloadSkillPackage(connection, capabilityId, version, signal) {
+	return downloadContent(connection, capabilityId, version, "application/zip", signal);
+}
+// src/skills/install.ts
+async function pathExists(path) {
+	return lstat(path).then(() => true, () => false);
+}
+function targetExistsError(path) {
+	return new HngrError({
+		type: "io",
+		title: `Target already exists: ${path}`,
+		detail: "Pass --force to replace it."
+	});
+}
+async function writeEntries(dest, entries) {
+	await mkdir(dest, { recursive: true });
+	for (const entry of entries) {
+		const path = resolve(dest, entry.path);
+		if (path !== dest && !path.startsWith(`${dest}${sep}`)) throw new HngrError({
+			type: "io",
+			title: `Refusing to write outside ${dest}`,
+			detail: `entry ${JSON.stringify(entry.path)} escapes the target directory`
+		});
+		await mkdir(dirname(path), { recursive: true });
+		await writeFile(path, entry.data, { mode: entry.mode & 73 ? 493 : 420 });
+	}
+}
+/**
+* Writes a skill through "temp directory → validate → rename": the target is
+* either absent or complete, never half-written. `--force` moves the old
+* directory aside before the rename so a failed swap puts it back.
+*/
+async function installAtomically(dest, entries, force) {
+	await writeDirectoryAtomically(dest, (temp) => writeEntries(temp, entries), {
+		force,
+		existsError: () => targetExistsError(dest)
+	});
+}
+/**
+* Creates a relative symlink to the canonical directory, falling back to a
+* copy when the platform refuses the link (Windows without Developer Mode).
+* Windows prefers a junction, which does not need elevated privileges; its
+* target must be absolute. A temp link plus rename replaces an existing link
+* atomically.
+*/
+async function linkAtomically(canonical, target, entries, force, options = {}) {
+	const exists = await pathExists(target);
+	if (exists && !force) throw targetExistsError(target);
+	await mkdir(dirname(target), { recursive: true });
+	const temp = resolve(dirname(target), `.hngr-${basename(target)}-${randomUUID()}.link`);
+	const windows = (options.platform ?? process.platform) === "win32";
+	const createLink = options.symlink ?? symlink;
+	try {
+		await createLink(windows ? canonical : relative(dirname(target), canonical), temp, windows ? "junction" : "dir");
+		if (exists) {
+			const stat = await lstat(target);
+			if (stat.isDirectory() && !stat.isSymbolicLink()) await rm(target, {
+				recursive: true,
+				force: true
+			});
+		}
+		await rename(temp, target);
+		return { mode: "symlink" };
+	} catch {
+		await rm(temp, { force: true }).catch(() => {});
+		await installAtomically(target, entries, false);
+		return {
+			mode: "copy",
+			warning: `warning: could not create a link at ${target}; copied instead`
+		};
+	}
+}
+/** Copies one target directory atomically, without a canonical store. */
+async function copyAtomically(target, entries, force) {
+	await installAtomically(target, entries, force);
+}
+// src/skills/resolve.ts
+/** Parses `<name>` or `<namespace>/<name>`, with an optional `@YYYY.MM.DD.N`. */
+function parseSkillPath(raw) {
+	return parseCapabilityPath(raw, SKILL_KIND);
+}
+function resolveSkill(connection, parsed, signal) {
+	return resolveCapability(connection, parsed, SKILL_KIND, signal);
+}
+/** The pinned version, or the capability's Current Version. */
+function resolveVersion(capability, parsed) {
+	return resolveCapabilityVersion(capability, parsed, SKILL_KIND);
+}
+// src/skills/zip.ts
+/** Limits: at most 25 MiB unpacked and 1000 files. */
+const MAX_UNPACKED_BYTES = 26214400;
+const MAX_FILES = 1e3;
+const EOCD_SIGNATURE = 101010256;
+const CENTRAL_SIGNATURE = 33639248;
+const LOCAL_SIGNATURE = 67324752;
+const ZIP64_MARKER = 4294967295;
+const MAX_EOCD_SEARCH = 65557;
+const FILE_TYPE_MASK$1 = 61440;
+const FILE_TYPE_DIRECTORY = 16384;
+const FILE_TYPE_SYMLINK$1 = 40960;
+const FILE_TYPE_REGULAR$1 = 32768;
+const ZIP_FLAG_ENCRYPTED = 1;
+function invalid$1(detail) {
+	return new HngrError({
+		type: "api",
+		title: "The Capability Package is not a valid Skill package",
+		detail
+	});
+}
+function hasDriveLetter$1(name) {
+	return /^[A-Za-z]:/.test(name);
+}
+/** Rejects names that could escape the target directory or confuse extraction. */
+function cleanEntryName(name) {
+	if (name.includes("\\")) throw invalid$1(`entry ${JSON.stringify(name)} uses a backslash; use / as the separator`);
+	if (name.startsWith("/") || hasDriveLetter$1(name)) throw invalid$1(`entry ${JSON.stringify(name)} is an absolute path`);
+	const withoutTrailingSlash = name.endsWith("/") ? name.slice(0, -1) : name;
+	for (const segment of withoutTrailingSlash.split("/")) {
+		if (segment === "..") throw invalid$1(`entry ${JSON.stringify(name)} contains a .. segment`);
+		if (segment === "" || segment === ".") throw invalid$1(`entry ${JSON.stringify(name)} is not a clean relative path`);
+		if (segment.includes("\0")) throw invalid$1(`entry ${JSON.stringify(name)} is not a clean relative path`);
+	}
+}
+function findEndOfCentralDirectory(buffer) {
+	const start = Math.max(0, buffer.length - MAX_EOCD_SEARCH);
+	for (let offset = buffer.length - 22; offset >= start; offset -= 1) if (buffer.readUInt32LE(offset) === EOCD_SIGNATURE) return offset;
+	throw invalid$1("the package is not a valid ZIP archive");
+}
+function readCentralDirectory(buffer) {
+	const eocd = findEndOfCentralDirectory(buffer);
+	const totalEntries = buffer.readUInt16LE(eocd + 10);
+	const directorySize = buffer.readUInt32LE(eocd + 12);
+	const directoryOffset = buffer.readUInt32LE(eocd + 16);
+	if (totalEntries === 65535 || directoryOffset === ZIP64_MARKER) throw invalid$1("ZIP64 packages are not supported");
+	if (directoryOffset + directorySize > buffer.length) throw invalid$1("the package is not a valid ZIP archive");
+	const entries = [];
+	let offset = directoryOffset;
+	for (let index = 0; index < totalEntries; index += 1) {
+		if (offset + 46 > buffer.length || buffer.readUInt32LE(offset) !== CENTRAL_SIGNATURE) throw invalid$1("the package is not a valid ZIP archive");
+		const flags = buffer.readUInt16LE(offset + 8);
+		const method = buffer.readUInt16LE(offset + 10);
+		const compressedSize = buffer.readUInt32LE(offset + 20);
+		const uncompressedSize = buffer.readUInt32LE(offset + 24);
+		const nameLength = buffer.readUInt16LE(offset + 28);
+		const extraLength = buffer.readUInt16LE(offset + 30);
+		const commentLength = buffer.readUInt16LE(offset + 32);
+		const externalAttributes = buffer.readUInt32LE(offset + 38);
+		const localHeaderOffset = buffer.readUInt32LE(offset + 42);
+		if (compressedSize === ZIP64_MARKER || uncompressedSize === ZIP64_MARKER) throw invalid$1("ZIP64 packages are not supported");
+		if (flags & ZIP_FLAG_ENCRYPTED) throw invalid$1("the package contains an encrypted entry");
+		const nameStart = offset + 46;
+		const nameEnd = nameStart + nameLength;
+		if (nameEnd > buffer.length) throw invalid$1("the package is not a valid ZIP archive");
+		const name = buffer.toString("utf8", nameStart, nameEnd);
+		const mode = externalAttributes >>> 16;
+		const type = mode & FILE_TYPE_MASK$1;
+		const directory = name.endsWith("/") || type === FILE_TYPE_DIRECTORY;
+		cleanEntryName(name);
+		if (!directory && type !== 0 && type !== FILE_TYPE_REGULAR$1) throw invalid$1(type === FILE_TYPE_SYMLINK$1 ? `entry ${JSON.stringify(name)} is a symbolic link` : `entry ${JSON.stringify(name)} is not a regular file or directory`);
+		if (method !== 0 && method !== 8) throw invalid$1(`entry ${JSON.stringify(name)} uses an unsupported compression method`);
+		entries.push({
+			name,
+			directory,
+			localHeaderOffset,
+			compressedSize,
+			uncompressedSize,
+			method,
+			mode
+		});
+		offset = nameEnd + extraLength + commentLength;
+	}
+	return entries;
+}
+function readEntryData(buffer, entry) {
+	const local = entry.localHeaderOffset;
+	if (local + 30 > buffer.length || buffer.readUInt32LE(local) !== LOCAL_SIGNATURE) throw invalid$1(`entry ${JSON.stringify(entry.name)} is corrupt`);
+	const nameLength = buffer.readUInt16LE(local + 26);
+	const extraLength = buffer.readUInt16LE(local + 28);
+	const dataStart = local + 30 + nameLength + extraLength;
+	const dataEnd = dataStart + entry.compressedSize;
+	if (dataEnd > buffer.length) throw invalid$1(`entry ${JSON.stringify(entry.name)} is corrupt`);
+	const compressed = buffer.subarray(dataStart, dataEnd);
+	let data;
+	if (entry.method === 0) data = Buffer.from(compressed);
+	else try {
+		data = inflateRawSync(compressed, { maxOutputLength: MAX_UNPACKED_BYTES });
+	} catch {
+		throw invalid$1(`entry ${JSON.stringify(entry.name)} is corrupt`);
+	}
+	if (data.length !== entry.uncompressedSize) throw invalid$1(`entry ${JSON.stringify(entry.name)} is corrupt`);
+	return data;
+}
+function lastSegment$1(name) {
+	return name.slice(name.lastIndexOf("/") + 1);
+}
+/** "dir/" when every entry lives under one top-level directory, otherwise "". */
+function packageRoot$1(names) {
+	let root = "";
+	let nested = false;
+	for (const name of names) {
+		const slash = name.indexOf("/");
+		const top = slash === -1 ? name : name.slice(0, slash);
+		if (root !== "" && top !== root) return "";
+		root = top;
+		nested = nested || slash !== -1;
+	}
+	return nested ? `${root}/` : "";
+}
+/**
+* Parses and validates a downloaded Capability Package. Nothing is written to
+* disk here; a rejected package fails before the installer touches a target.
+*/
+function readSkillPackage(buffer) {
+	if (buffer.length < 22) throw invalid$1("the package is not a valid ZIP archive");
+	const raw = readCentralDirectory(buffer);
+	const files = raw.filter((entry) => !entry.directory);
+	if (files.length > 1e3) throw invalid$1(`the package has ${files.length} files; the limit is ${MAX_FILES}`);
+	let declaredBytes = 0;
+	for (const entry of raw) {
+		declaredBytes += entry.uncompressedSize;
+		if (declaredBytes > 26214400) throw invalid$1(`the package unpacks to more than ${MAX_UNPACKED_BYTES / 1048576} MiB`);
+	}
+	const names = raw.map((entry) => entry.directory ? entry.name.slice(0, -1) : entry.name);
+	const seen = /* @__PURE__ */ new Set();
+	for (const name of names) {
+		const folded = name.toLowerCase();
+		if (seen.has(folded)) throw invalid$1(`entry ${JSON.stringify(name)} appears more than once`);
+		seen.add(folded);
+	}
+	const manifests = files.filter((entry) => lastSegment$1(entry.name).toLowerCase() === "skill.md");
+	if (manifests.length === 0) throw invalid$1("the package has no SKILL.md");
+	if (manifests.length > 1) throw invalid$1(`the package has more than one SKILL.md: ${manifests.map((entry) => entry.name).join(", ")}`);
+	const root = packageRoot$1(names);
+	const expectedManifest = `${root}SKILL.md`;
+	if (manifests[0]?.name !== expectedManifest) throw invalid$1(`found ${manifests[0]?.name}, but the package needs SKILL.md at its root or inside its single top-level directory`);
+	let actualBytes = 0;
+	const entries = [];
+	let manifest;
+	for (const entry of files) {
+		const data = readEntryData(buffer, entry);
+		actualBytes += data.length;
+		if (actualBytes > 26214400) throw invalid$1(`the package unpacks to more than ${MAX_UNPACKED_BYTES / 1048576} MiB`);
+		const path = entry.name.slice(root.length);
+		entries.push({
+			path,
+			data,
+			mode: entry.mode & 511
+		});
+		if (path === "SKILL.md") manifest = data;
+	}
+	if (!manifest) throw invalid$1("the package has no SKILL.md");
+	return {
+		entries,
+		manifest
+	};
+}
+// src/skills/zip-write.ts
+/** The same limits the installer enforces for a downloaded Skill package. */
+const MAX_PACKAGE_FILES = 1e3;
+const MAX_PACKAGE_BYTES = 26214400;
+const FILE_TYPE_MASK = 61440;
+const FILE_TYPE_SYMLINK = 40960;
+const FILE_TYPE_REGULAR = 32768;
+function invalid(detail) {
+	return new HngrError({
+		type: "usage",
+		title: "The Skill directory is not a valid Capability Package",
+		detail
+	});
+}
+function hasDriveLetter(name) {
+	return /^[A-Za-z]:/.test(name);
+}
+/** Rejects archive paths that could escape an extraction; also used for local names. */
+function validateArchivePath(name) {
+	if (name.includes("\\")) throw invalid(`entry ${JSON.stringify(name)} uses a backslash; use / as the separator`);
+	if (name.startsWith("/") || hasDriveLetter(name)) throw invalid(`entry ${JSON.stringify(name)} is an absolute path`);
+	const withoutTrailingSlash = name.endsWith("/") ? name.slice(0, -1) : name;
+	for (const segment of withoutTrailingSlash.split("/")) {
+		if (segment === "..") throw invalid(`entry ${JSON.stringify(name)} contains a .. segment`);
+		if (segment === "" || segment === "." || segment.includes("\0")) throw invalid(`entry ${JSON.stringify(name)} is not a clean relative path`);
+	}
+}
+const CRC_TABLE = (() => {
+	const table = /* @__PURE__ */ new Uint32Array(256);
+	for (let n = 0; n < 256; n += 1) {
+		let c = n;
+		for (let k = 0; k < 8; k += 1) c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+		table[n] = c >>> 0;
+	}
+	return table;
+})();
+function crc32(data) {
+	let crc = 4294967295;
+	for (const byte of data) crc = (CRC_TABLE[(crc ^ byte) & 255] ?? 0) ^ crc >>> 8;
+	return (crc ^ 4294967295) >>> 0;
+}
+/**
+* Builds a ZIP archive in memory. Files are deflated; directory entries are
+* unnecessary because every reader derives them from the file paths.
+*/
+function buildZip(entries) {
+	const locals = [];
+	const centrals = [];
+	let offset = 0;
+	for (const entry of entries) {
+		const data = entry.data;
+		const stored = deflateRawSync(data);
+		const crc = crc32(data);
+		const name = Buffer.from(entry.path, "utf8");
+		const externalAttrs = (entry.mode & 511 | FILE_TYPE_REGULAR) * 65536 >>> 0;
+		const local = Buffer.alloc(30);
+		local.writeUInt32LE(67324752, 0);
+		local.writeUInt16LE(20, 4);
+		local.writeUInt16LE(0, 6);
+		local.writeUInt16LE(8, 8);
+		local.writeUInt16LE(0, 10);
+		local.writeUInt16LE(0, 12);
+		local.writeUInt32LE(crc, 14);
+		local.writeUInt32LE(stored.length, 18);
+		local.writeUInt32LE(data.length, 22);
+		local.writeUInt16LE(name.length, 26);
+		local.writeUInt16LE(0, 28);
+		locals.push(local, name, stored);
+		const central = Buffer.alloc(46);
+		central.writeUInt32LE(33639248, 0);
+		central.writeUInt16LE(798, 4);
+		central.writeUInt16LE(20, 6);
+		central.writeUInt16LE(0, 8);
+		central.writeUInt16LE(8, 10);
+		central.writeUInt16LE(0, 12);
+		central.writeUInt16LE(0, 14);
+		central.writeUInt32LE(crc, 16);
+		central.writeUInt32LE(stored.length, 20);
+		central.writeUInt32LE(data.length, 24);
+		central.writeUInt16LE(name.length, 28);
+		central.writeUInt16LE(0, 30);
+		central.writeUInt16LE(0, 32);
+		central.writeUInt16LE(0, 34);
+		central.writeUInt16LE(0, 36);
+		central.writeUInt32LE(externalAttrs, 38);
+		central.writeUInt32LE(offset, 42);
+		centrals.push(central, name);
+		offset += local.length + name.length + stored.length;
+	}
+	const centralDirectory = Buffer.concat(centrals);
+	const eocd = Buffer.alloc(22);
+	eocd.writeUInt32LE(101010256, 0);
+	eocd.writeUInt16LE(0, 4);
+	eocd.writeUInt16LE(0, 6);
+	eocd.writeUInt16LE(entries.length, 8);
+	eocd.writeUInt16LE(entries.length, 10);
+	eocd.writeUInt32LE(centralDirectory.length, 12);
+	eocd.writeUInt32LE(offset, 16);
+	eocd.writeUInt16LE(0, 20);
+	return Buffer.concat([
+		...locals,
+		centralDirectory,
+		eocd
+	]);
+}
+function lastSegment(name) {
+	return name.slice(name.lastIndexOf("/") + 1);
+}
+/** "dir/" when every path lives under one top-level directory, otherwise "". */
+function packageRoot(names) {
+	let root = "";
+	let nested = false;
+	for (const name of names) {
+		const slash = name.indexOf("/");
+		const top = slash === -1 ? name : name.slice(0, slash);
+		if (root !== "" && top !== root) return "";
+		root = top;
+		nested = nested || slash !== -1;
+	}
+	return nested ? `${root}/` : "";
+}
+async function walk(base, relative, entries, totals) {
+	let dirents;
+	try {
+		dirents = await readdir(relative === "" ? base : join(base, relative), { withFileTypes: true });
+	} catch (err) {
+		throw new HngrError({
+			type: "io",
+			title: `Could not read ${relative === "" ? base : join(base, relative)}`,
+			detail: err instanceof Error ? err.message : String(err)
+		});
+	}
+	dirents.sort((left, right) => left.name.localeCompare(right.name));
+	for (const dirent of dirents) {
+		const path = relative === "" ? dirent.name : `${relative}/${dirent.name}`;
+		const absolute = join(base, path);
+		if (dirent.isSymbolicLink()) throw invalid(`entry ${JSON.stringify(path)} is a symbolic link`);
+		if (dirent.isDirectory()) {
+			await walk(base, path, entries, totals);
+			continue;
+		}
+		if (!dirent.isFile()) throw invalid(`entry ${JSON.stringify(path)} is not a regular file or directory`);
+		validateArchivePath(path);
+		const stats = await lstat(absolute);
+		const type = stats.mode & FILE_TYPE_MASK;
+		if (type === FILE_TYPE_SYMLINK) throw invalid(`entry ${JSON.stringify(path)} is a symbolic link`);
+		if (type !== FILE_TYPE_REGULAR && type !== 0) throw invalid(`entry ${JSON.stringify(path)} is not a regular file or directory`);
+		if (totals.bytes + stats.size > 26214400) throw invalid(`the directory unpacks to more than ${MAX_PACKAGE_BYTES / 1048576} MiB`);
+		const data = await readFile(absolute);
+		totals.bytes += data.length;
+		if (totals.bytes > 26214400) throw invalid(`the directory unpacks to more than ${MAX_PACKAGE_BYTES / 1048576} MiB`);
+		entries.push({
+			path,
+			data,
+			mode: stats.mode & 511
+		});
+		if (entries.length > 1e3) throw invalid(`the directory has ${entries.length} files; the limit is ${MAX_PACKAGE_FILES}`);
+	}
+}
+/**
+* Reads and validates a local Skill directory, then packs it into a ZIP in
+* memory. Every rule mirrors the installer's package validation, so a
+* directory that passes here also passes the server. Nothing is uploaded.
+*/
+async function packageSkillDirectory(dir) {
+	const base = resolve(dir);
+	let stats;
+	try {
+		stats = await lstat(base);
+	} catch (err) {
+		throw new HngrError({
+			type: "io",
+			title: `Could not read ${dir}`,
+			detail: err instanceof Error ? err.message : String(err)
+		});
+	}
+	if (!stats.isDirectory()) throw invalid(`${JSON.stringify(dir)} is not a directory`);
+	if ((stats.mode & FILE_TYPE_MASK) === FILE_TYPE_SYMLINK) throw invalid(`${JSON.stringify(dir)} is a symbolic link`);
+	const entries = [];
+	const totals = { bytes: 0 };
+	await walk(base, "", entries, totals);
+	const seen = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		const folded = entry.path.toLowerCase();
+		if (seen.has(folded)) throw invalid(`entry ${JSON.stringify(entry.path)} appears more than once`);
+		seen.add(folded);
+	}
+	const manifests = entries.filter((entry) => lastSegment(entry.path).toLowerCase() === "skill.md");
+	if (manifests.length === 0) throw invalid("the directory has no SKILL.md");
+	if (manifests.length > 1) throw invalid(`the directory has more than one SKILL.md: ${manifests.map((entry) => entry.path).join(", ")}`);
+	const expected = `${packageRoot(entries.map((entry) => entry.path))}SKILL.md`;
+	if (manifests[0]?.path !== expected) throw invalid(`found ${manifests[0]?.path}, but the package needs SKILL.md at its root or inside its single top-level directory`);
+	return {
+		zip: buildZip(entries),
+		fileCount: entries.length,
+		byteCount: totals.bytes
+	};
+}
+// src/commands/skills.ts
+function usage(title, detail) {
+	return new HngrError({
+		type: "usage",
+		title,
+		detail
+	});
+}
+function stringFlag(argv, name) {
+	const value = argv[name];
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
+function displayPath(path, cwd) {
+	const rel = relative(cwd, path);
+	if (rel !== "" && !rel.startsWith("..") && !isAbsolute(rel)) return rel.split(sep).join("/");
+	return path;
+}
+function failureResult(parsed, err, version) {
+	return {
+		...failedResult(parsed, err, version),
+		canonicalPath: null
+	};
+}
+/** Prompts need both stdin and stdout on a TTY plus a prompter that can multi-select. */
+function canPrompt(ctx) {
+	return ctx.io.stdin.isTTY && ctx.io.stdout.isTTY && ctx.io.prompts?.multiselect !== void 0;
+}
+function noAgentSelectionError(examplePath, global) {
+	return usage("No agent target selected", `Pass --agent <id> (repeatable) or --all. For example: hngr skills add ${examplePath} --agent claude-code${global ? " --global" : ""}`);
+}
+/**
+* One multi-select for every Agent Target, pre-selecting those whose skills
+* directory is detected. Detection is only a pre-selection hint; a non-TTY
+* invocation never consults the filesystem and must pass --agent or --all.
+*/
+async function selectAgents(ctx, argv, examplePath, global) {
+	const requested = stringValues(argv.agent);
+	if (requested.length > 0) {
+		const unknown = requested.filter((id) => findAgent(id) === void 0);
+		if (unknown.length > 0) throw usage(`Unknown agent target: ${unknown.join(", ")}`, `Known targets: ${agentIds().join(", ")}.`);
+		return AGENT_TARGETS.filter((agent) => requested.includes(agent.id));
+	}
+	if (argv.all === true) return [...AGENT_TARGETS];
+	if (canPrompt(ctx)) {
+		const multiselect = ctx.io.prompts?.multiselect;
+		if (!multiselect) throw noAgentSelectionError(examplePath, global);
+		const cwd = process.cwd();
+		const choices = [];
+		for (const agent of AGENT_TARGETS) {
+			const dir = targetSkillsDir(agent, cwd, ctx.env, global);
+			choices.push({
+				option: {
+					value: agent.id,
+					label: `${agent.id}  ${displayPath(dir, cwd)}`
+				},
+				detected: await pathExists(dirname(dir))
+			});
+		}
+		const selected = await multiselect("Select agent targets", choices.map((choice) => choice.option), choices.filter((choice) => choice.detected).map((choice) => choice.option.value));
+		if (selected.length === 0) throw noAgentSelectionError(examplePath, global);
+		return AGENT_TARGETS.filter((agent) => selected.includes(agent.id));
+	}
+	throw noAgentSelectionError(examplePath, global);
+}
+function frontmatterName(manifest) {
+	const text = manifest.toString("utf8");
+	const block = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(text);
+	if (!block) return;
+	const line = /^name:\s*(.*)$/m.exec(block[1] ?? "");
+	if (!line) return;
+	const value = (line[1] ?? "").trim().replace(/^(["'])(.*)\1$/, "$2").trim();
+	return value === "" ? void 0 : value;
+}
+function assertNotReserved(name) {
+	if (isReservedDirName(name)) throw usage(`Reserved directory name: ${name}`, "The names `synced` and `anthropic-skills` are reserved for agent-owned skill stores.");
+}
+function planInstall(cwd, env, destName, agents, options) {
+	if (options.dir) {
+		const base = resolve(cwd, options.dir);
+		return {
+			canonical: null,
+			targets: [{
+				agent: null,
+				path: join(base, destName),
+				mode: "copy"
+			}]
+		};
+	}
+	const targets = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const agent of agents) {
+		if (!options.copy && !agent.link) continue;
+		const base = options.copy ? targetSkillsDir(agent, cwd, env, options.global) : agentSkillsDir(agent, cwd, env, options.global);
+		if (!base) continue;
+		const path = join(base, destName);
+		if (seen.has(path)) continue;
+		seen.add(path);
+		targets.push({
+			agent: agent.id,
+			path,
+			mode: options.copy ? "copy" : "symlink"
+		});
+	}
+	if (options.copy) {
+		if (targets.length === 0) throw usage("No copy target selected", "Pass --agent claude-code or --all.");
+		return {
+			canonical: null,
+			targets
+		};
+	}
+	return {
+		canonical: join(canonicalSkillsDir(cwd, env, options.global), destName),
+		targets
+	};
+}
+async function install(ctx, plan, entries) {
+	const cwd = process.cwd();
+	const display = (path) => displayPath(path, cwd);
+	const destinations = [plan.canonical, ...plan.targets.map((target) => target.path)].filter((path) => path !== null);
+	if (!ctx.flags.force) {
+		for (const path of destinations) if (await pathExists(path)) throw targetExistsError(display(path));
+	}
+	if (plan.canonical) await installAtomically(plan.canonical, entries, ctx.flags.force);
+	const installed = [];
+	let failure = null;
+	for (const target of plan.targets) try {
+		if (target.mode === "copy" || !plan.canonical) {
+			await copyAtomically(target.path, entries, ctx.flags.force);
+			installed.push({
+				agent: target.agent,
+				path: display(target.path),
+				mode: "copy",
+				status: "installed"
+			});
+			continue;
+		}
+		const result = await linkAtomically(plan.canonical, target.path, entries, ctx.flags.force);
+		if (result.warning) ctx.summary(result.warning);
+		installed.push({
+			agent: target.agent,
+			path: display(target.path),
+			mode: result.mode,
+			status: "installed"
+		});
+	} catch (err) {
+		failure ??= err;
+		installed.push({
+			agent: target.agent,
+			path: display(target.path),
+			mode: target.mode,
+			status: "failed"
+		});
+	}
+	return {
+		targets: installed,
+		failure
+	};
+}
+async function addOne(ctx, connection, parsed, destName, agents, dir, global, copy, state) {
+	const capability = await resolveSkill(connection, parsed);
+	const version = resolveVersion(capability, parsed);
+	state.version = version;
+	const plan = planInstall(process.cwd(), ctx.env, destName, agents, {
+		dir,
+		global,
+		copy
+	});
+	const canonicalPath = plan.canonical ? displayPath(plan.canonical, process.cwd()) : null;
+	if (ctx.flags.dryRun) {
+		if (!ctx.flags.force) {
+			for (const path of [plan.canonical, ...plan.targets.map((target) => target.path)]) if (path && await pathExists(path)) throw targetExistsError(displayPath(path, process.cwd()));
+		}
+		ctx.summary(`resolved ${parsed.namespace}/${parsed.name} to version ${version}`);
+		return { result: {
+			name: capability.name,
+			namespace: capability.namespace,
+			version,
+			status: "dry-run",
+			canonicalPath,
+			targets: plan.targets.map((target) => ({
+				agent: target.agent,
+				path: displayPath(target.path, process.cwd()),
+				mode: target.mode,
+				status: "dry-run"
+			})),
+			error: null
+		} };
+	}
+	const download = await downloadSkillPackage(connection, capability.id, version);
+	const pkg = readSkillPackage(download.bytes);
+	ctx.summary(`resolved ${parsed.namespace}/${parsed.name} to version ${version}`);
+	const declaredName = frontmatterName(pkg.manifest);
+	if (declaredName !== void 0 && declaredName !== destName) ctx.summary(`warning: SKILL.md declares name ${JSON.stringify(declaredName)} but the directory is ${JSON.stringify(destName)}`);
+	const outcome = await install(ctx, plan, pkg.entries);
+	const universal = agents.filter((agent) => !agent.link).map((agent) => agent.id);
+	const etag = download.etag ? ` (ETag ${download.etag})` : "";
+	const verb = outcome.failure ? "partially installed" : "installed";
+	ctx.progress(`${verb} ${capability.namespace}/${capability.name}@${version}${etag}`);
+	if (canonicalPath) ctx.progress(`  canonical ${canonicalPath}`);
+	if (universal.length > 0) ctx.progress(`  universal: ${universal.join(", ")}`);
+	for (const target of outcome.targets) ctx.progress(target.status === "failed" ? `  failed ${target.path}` : `  ${target.mode} ${target.path}`);
+	return { result: {
+		name: capability.name,
+		namespace: capability.namespace,
+		version,
+		status: outcome.failure ? "failed" : "installed",
+		canonicalPath,
+		targets: outcome.targets,
+		error: outcome.failure ? errorBody(outcome.failure) : null
+	} };
+}
+const CAPABILITIES_PATH = "/api/v1/capabilities";
+function packagePart(pkg, name) {
+	return {
+		name: "package",
+		filename: `${name}.zip`,
+		contentType: "application/zip",
+		data: pkg.zip
+	};
+}
+/** Create and version forms share fields; the server requires package last. */
+function skillPrepared(pkg, metadata) {
+	const createParts = () => {
+		const parts = [
+			{
+				name: "namespace",
+				value: metadata.namespace
+			},
+			{
+				name: "name",
+				value: metadata.name
+			},
+			{
+				name: "description",
+				value: metadata.description ?? ""
+			},
+			{
+				name: "visibility",
+				value: metadata.visibility
+			}
+		];
+		if (metadata.readme !== void 0) parts.push({
+			name: "readme",
+			value: metadata.readme
+		});
+		if (metadata.tags.length > 0) parts.push({
+			name: "tags",
+			value: metadata.tags.join(",")
+		});
+		parts.push(packagePart(pkg, metadata.name));
+		return parts;
+	};
+	const versionParts = () => {
+		const parts = [];
+		if (metadata.readme !== void 0) parts.push({
+			name: "readme",
+			value: metadata.readme
+		});
+		parts.push(packagePart(pkg, metadata.name));
+		return parts;
+	};
+	return {
+		preview() {
+			const preview = {
+				namespace: metadata.namespace,
+				name: metadata.name
+			};
+			if (metadata.description !== void 0) preview.description = metadata.description;
+			preview.visibility = metadata.visibility;
+			if (metadata.readme !== void 0) preview.readme = metadata.readme;
+			if (metadata.tags.length > 0) preview.tags = metadata.tags.join(",");
+			preview.package = `<${pkg.fileCount} files, ${pkg.byteCount} bytes>`;
+			return preview;
+		},
+		async create(connection) {
+			return (await postMultipart(connection, CAPABILITIES_PATH, createParts())).json();
+		},
+		async version(connection, capabilityId) {
+			return (await postMultipart(connection, `${CAPABILITIES_PATH}/${encodeURIComponent(capabilityId)}/versions`, versionParts())).json();
+		}
+	};
+}
+/**
+* Publishes local Skill directories. Each directory is validated and packed in
+* memory; an existing capability receives a new version unless --new is set.
+*/
+async function publish(ctx, argv) {
+	const rawPaths = positionalPaths(argv.paths);
+	if (rawPaths.length === 0) throw usage("No skill directory given", "Pass one or more local directories that contain SKILL.md.");
+	const flags = await readPublishFlags(argv, "skill");
+	const forcedName = explicitName(argv, rawPaths.length);
+	const items = rawPaths.map((dir) => ({
+		name: forcedName ?? basename(resolve(dir)),
+		prepare: async (metadata) => skillPrepared(await packageSkillDirectory(dir), metadata)
+	}));
+	return runPublish({
+		ctx,
+		kind: "skill",
+		info: SKILL_KIND,
+		...flags,
+		items
+	});
+}
+async function add(ctx, argv) {
+	const rawPaths = positionalPaths(argv.paths);
+	if (rawPaths.length === 0) throw usage("No skill path given", "Pass one or more `<name>` or `<namespace>/<name>` arguments.");
+	const parsedPaths = rawPaths.map(parseSkillPath);
+	const dir = stringFlag(argv, "dir");
+	const as = stringFlag(argv, "as");
+	if (as !== void 0 && (as.includes("/") || as.includes("\\") || as === "." || as === "..")) throw usage(`Invalid --as name ${JSON.stringify(as)}`, "Pass a single directory name.");
+	const global = argv.global === true;
+	const copy = argv.copy === true;
+	if (dir !== void 0 && global) throw usage("--dir cannot be combined with --global");
+	if (dir !== void 0 && (stringValues(argv.agent).length > 0 || argv.all === true)) throw usage("--dir cannot be combined with --agent or --all");
+	if (as !== void 0) assertNotReserved(as);
+	for (const parsed of parsedPaths) assertNotReserved(as ?? parsed.name);
+	const agents = dir === void 0 ? await selectAgents(ctx, argv, rawPaths[0] ?? "", global) : [];
+	const connection = await resolveConnection(ctx.flags, ctx.env);
+	const { results, failed } = await runBatch({
+		ctx,
+		paths: parsedPaths,
+		run: async (parsed, state) => {
+			return (await addOne(ctx, connection, parsed, as ?? parsed.name, agents, dir, global, copy, state)).result;
+		},
+		failure: failureResult
+	});
+	ctx.writePayload({ results });
+	return failed ? 1 : 0;
+}
+export { add, publish };