ht-skills 0.1.7 → 0.2.0

package/README.md

@@ -11,8 +11,14 @@ npx ht-skills add --skill repo-bug-analyze
 ## Commands
 
 ```text
+ht-skills login [--registry <url>]
+ht-skills publish [skillDir] [--registry <url>] [--visibility public|private|shared] [--shared-with a@b.com,c@d.com] [--publish-now]
 ht-skills search <query> [--registry <url>] [--limit <n>]
 ht-skills submit <skillDir> [--registry <url>] [--submitter <name>] [--visibility public|private|shared] [--shared-with a@b.com,c@d.com] [--publish-now]
 ht-skills install <slug[@version]> [more-skills...] [--registry <url>] [--target <dir>] [--tool codex|claude|vscode]
 ht-skills add [registry] --skill <slug[@version]>,<slug[@version]> [--tool codex|claude|vscode]
 ```
+
+`login` opens the browser, completes marketplace sign-in, and stores a registry token under `~/.ht-skills/config.json`.
+
+`publish` zips the target skill directory, uploads it through the marketplace package inspection flow, and then submits the generated preview token for review.

package/lib/cli.js

@@ -1,7 +1,9 @@
 const fs = require("fs/promises");
 const os = require("os");
 const path = require("path");
+const { spawn } = require("child_process");
 const readline = require("readline/promises");
+const AdmZip = require("adm-zip");
 
 const INSTALL_TARGETS = {
   codex: {
@@ -29,6 +31,11 @@ const TOOL_ALIASES = {
   "github-copilot": "vscode",
 };
 const DEFAULT_REGISTRY_URL = "http://skills.ic.aeroht.local";
+const CONFIG_DIR_NAME = ".ht-skills";
+const CONFIG_FILE_NAME = "config.json";
+const DEFAULT_LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+const DEFAULT_LOGIN_POLL_MS = 1500;
+const DEFAULT_PUBLISH_POLL_MS = 1500;
 
 const BANNER_TEXT = String.raw`  _  _ _____   ___ _   _ _ _      __  __          _       _        _         
  | || |_   _| / __| |_(_) | |___ |  \/  |__ _ _ _| |_____| |_ _ __| |__ _ __ 
@@ -40,12 +47,16 @@ function printHelp() {
   // eslint-disable-next-line no-console
   console.log(`Usage:
   ht-skills search <query> [--registry <url>] [--limit <n>]
+  ht-skills login [--registry <url>]
+  ht-skills publish [skillDir] [--registry <url>] [--visibility public|private|shared] [--shared-with a@b.com,c@d.com] [--publish-now]
   ht-skills submit <skillDir> [--registry <url>] [--submitter <name>] [--visibility public|private|shared] [--shared-with a@b.com,c@d.com] [--publish-now]
   ht-skills install <slug[@version]> [more-skills...] [--registry <url>] [--target <dir>] [--tool codex|claude|vscode]
   ht-skills add [registry] --skill <slug[@version]>,<slug[@version]> [--tool codex|claude|vscode]
 
 Examples:
   ht-skills search openai
+  ht-skills login
+  ht-skills publish .
   ht-skills submit ./examples/hello-skill
   ht-skills install hello-skill@1.0.0 --tool codex
   ht-skills install hello-skill repo-bug-analyze --tool codex
@@ -103,6 +114,130 @@ async function requestJson(url, options = {}) {
   return payload;
 }
 
+function getConfigPath(homeDir = os.homedir()) {
+  return path.join(homeDir, CONFIG_DIR_NAME, CONFIG_FILE_NAME);
+}
+
+async function loadCliConfig(homeDir = os.homedir()) {
+  const configPath = getConfigPath(homeDir);
+  try {
+    const raw = await fs.readFile(configPath, "utf8");
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return {};
+    }
+    throw error;
+  }
+}
+
+async function saveCliConfig(config, homeDir = os.homedir()) {
+  const configPath = getConfigPath(homeDir);
+  await fs.mkdir(path.dirname(configPath), { recursive: true });
+  await fs.writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+}
+
+function getRegistryConfigKey(registry) {
+  return String(registry || "").replace(/\/$/, "");
+}
+
+async function getStoredRegistryAuth(registry, { homeDir = os.homedir() } = {}) {
+  const config = await loadCliConfig(homeDir);
+  return config.registries?.[getRegistryConfigKey(registry)] || null;
+}
+
+async function setStoredRegistryAuth(registry, value, { homeDir = os.homedir() } = {}) {
+  const config = await loadCliConfig(homeDir);
+  if (!config.registries || typeof config.registries !== "object") {
+    config.registries = {};
+  }
+  config.registries[getRegistryConfigKey(registry)] = value;
+  await saveCliConfig(config, homeDir);
+}
+
+async function resolveAuthToken(registry, flags, { homeDir = os.homedir() } = {}) {
+  const inlineToken = String(flags.token || "").trim();
+  if (inlineToken) {
+    return inlineToken;
+  }
+  const stored = await getStoredRegistryAuth(registry, { homeDir });
+  return String(stored?.token || "").trim() || null;
+}
+
+async function getRequiredAuthToken(registry, flags, { homeDir = os.homedir() } = {}) {
+  const token = await resolveAuthToken(registry, flags, { homeDir });
+  if (!token) {
+    throw new Error(`No saved login for ${registry}. Run "ht-skills login --registry ${registry}" first.`);
+  }
+  return token;
+}
+
+function withBearerToken(headers = {}, token = null) {
+  if (!token) return { ...headers };
+  return {
+    ...headers,
+    authorization: `Bearer ${token}`,
+  };
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function openBrowserUrl(url) {
+  const safeUrl = String(url || "").trim();
+  if (!safeUrl) {
+    throw new Error("browser URL is required");
+  }
+
+  let child;
+  if (process.platform === "win32") {
+    child = spawn("cmd", ["/c", "start", "", safeUrl], {
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true,
+    });
+  } else if (process.platform === "darwin") {
+    child = spawn("open", [safeUrl], {
+      detached: true,
+      stdio: "ignore",
+    });
+  } else {
+    child = spawn("xdg-open", [safeUrl], {
+      detached: true,
+      stdio: "ignore",
+    });
+  }
+
+  child.on("error", () => {});
+  child.unref();
+}
+
+async function createZipFromDirectory(skillDir) {
+  const zip = new AdmZip();
+  const files = await walkFiles(skillDir);
+  if (files.length === 0) {
+    throw new Error(`No files found under ${skillDir}`);
+  }
+
+  for (const absolutePath of files) {
+    const content = await fs.readFile(absolutePath);
+    const relativePath = path.relative(skillDir, absolutePath).replace(/\\/g, "/");
+    zip.addFile(relativePath, content);
+  }
+
+  return zip.toBuffer();
+}
+
+function summarizePreviewErrors(preview) {
+  const errors = Array.isArray(preview?.errors) ? preview.errors.filter(Boolean) : [];
+  if (errors.length === 0) {
+    return "archive inspection failed";
+  }
+  return errors.slice(0, 4).join("; ");
+}
+
 function formatInstallError(error, { slug, version = null, registry, stage = "resolve" }) {
   const rawMessage = String(error?.message || "Install failed").trim();
   const status = Number(error?.status || 0);
@@ -1017,11 +1152,153 @@ async function cmdInstall(flags, deps = {}) {
   return allTargets;
 }
 
+async function cmdLogin(flags, deps = {}) {
+  const requestJsonImpl = deps.requestJson || requestJson;
+  const log = deps.log || ((message) => console.log(message));
+  const openBrowser = deps.openBrowser || openBrowserUrl;
+  const homeDir = deps.homeDir || os.homedir();
+  const registry = getRegistryUrl(flags);
+  const timeoutMs = Math.max(10_000, Number(flags.timeout || deps.timeoutMs || DEFAULT_LOGIN_TIMEOUT_MS));
+  const pollIntervalMs = Math.max(500, Number(flags["poll-interval"] || deps.pollIntervalMs || DEFAULT_LOGIN_POLL_MS));
+
+  const started = await requestJsonImpl(`${registry}/api/cli/auth/start`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+    },
+    body: JSON.stringify({
+      client: "ht-skills",
+    }),
+  });
+
+  const browserUrl = String(started.browser_url || "").trim();
+  const requestId = String(started.request_id || "").trim();
+  const pollUrl = String(started.poll_url || `${registry}/api/cli/auth/poll/${encodeURIComponent(requestId)}`).trim();
+  if (!browserUrl || !requestId) {
+    throw new Error("registry did not return a usable CLI login flow");
+  }
+
+  try {
+    await Promise.resolve(openBrowser(browserUrl));
+    log(`Opened browser for ${registry}. Complete sign-in to continue...`);
+  } catch (error) {
+    log(`Open this URL in your browser and sign in:\n${browserUrl}`);
+  }
+
+  const expiresAtMs = Date.parse(started.expires_at || "") || (Date.now() + timeoutMs);
+  const deadline = Math.min(Date.now() + timeoutMs, expiresAtMs);
+
+  while (Date.now() <= deadline) {
+    await sleep(pollIntervalMs);
+    const status = await requestJsonImpl(pollUrl);
+    if (status.status === "approved") {
+      await setStoredRegistryAuth(registry, {
+        token: status.token,
+        user: status.user || null,
+        tokenExpiresAt: status.token_expires_at || null,
+        savedAt: new Date().toISOString(),
+      }, { homeDir });
+      const userLabel = status.user?.name || status.user?.email || status.user?.id || "user";
+      log(`Signed in to ${registry} as ${userLabel}.`);
+      return status;
+    }
+  }
+
+  throw new Error(`Timed out waiting for browser sign-in at ${registry}`);
+}
+
+async function cmdPublish(flags, deps = {}) {
+  const requestJsonImpl = deps.requestJson || requestJson;
+  const log = deps.log || ((message) => console.log(message));
+  const homeDir = deps.homeDir || os.homedir();
+  const registry = getRegistryUrl(flags);
+  const skillDir = path.resolve(flags._[0] || ".");
+  const token = await getRequiredAuthToken(registry, flags, { homeDir });
+  const archiveName = `${path.basename(skillDir) || "skill"}.zip`;
+  const archiveBuffer = await createZipFromDirectory(skillDir);
+  const pollIntervalMs = Math.max(500, Number(flags["poll-interval"] || deps.pollIntervalMs || DEFAULT_PUBLISH_POLL_MS));
+
+  const job = await requestJsonImpl(
+    `${registry}/api/skills/inspect-package-jobs/upload?archive_name=${encodeURIComponent(archiveName)}`,
+    {
+      method: "POST",
+      headers: withBearerToken({
+        "content-type": "application/zip",
+      }, token),
+      body: archiveBuffer,
+    },
+  );
+
+  const jobId = String(job.job_id || "").trim();
+  if (!jobId) {
+    throw new Error("registry did not return an inspection job id");
+  }
+
+  let inspection = job;
+  while (inspection.status !== "succeeded" && inspection.status !== "failed") {
+    await sleep(pollIntervalMs);
+    inspection = await requestJsonImpl(
+      `${registry}/api/skills/inspect-package-jobs/${encodeURIComponent(jobId)}`,
+      {
+        headers: withBearerToken({}, token),
+      },
+    );
+  }
+
+  if (inspection.status !== "succeeded") {
+    throw new Error(inspection.error || "skill archive inspection failed");
+  }
+
+  const preview = inspection.result || {};
+  if (!preview.valid || !preview.preview_token) {
+    throw new Error(summarizePreviewErrors(preview));
+  }
+
+  const body = {
+    preview_token: preview.preview_token,
+  };
+  if (flags.visibility) {
+    body.visibility = String(flags.visibility);
+  }
+  if (flags["shared-with"]) {
+    body.shared_with = String(flags["shared-with"])
+      .split(",")
+      .map((item) => item.trim())
+      .filter(Boolean);
+  }
+  if (flags["publish-now"]) {
+    body.publish_now = true;
+  }
+
+  const result = await requestJsonImpl(`${registry}/api/skills/submit`, {
+    method: "POST",
+    headers: withBearerToken({
+      "content-type": "application/json",
+    }, token),
+    body: JSON.stringify(body),
+  });
+
+  log(JSON.stringify({
+    status: result.status,
+    submission_id: result.submission_id || null,
+    created_at: result.created_at || null,
+    visibility: result.visibility || body.visibility || null,
+    publication: result.publication || null,
+    preview_token: preview.preview_token,
+    archive_name: archiveName,
+  }, null, 2));
+
+  return result;
+}
+
 async function cmdSubmit(flags, deps = {}) {
   const requestJsonImpl = deps.requestJson || requestJson;
   const log = deps.log || ((message) => console.log(message));
+  const homeDir = deps.homeDir || os.homedir();
   const skillDirArg = flags._[0] || ".";
   const skillDir = path.resolve(skillDirArg);
+  const registry = getRegistryUrl(flags);
+  const token = await getRequiredAuthToken(registry, flags, { homeDir });
   const manifestPath = path.resolve(flags.manifest || path.join(skillDir, "skill.json"));
   const manifestRaw = await fs.readFile(manifestPath, "utf8");
   const manifest = JSON.parse(manifestRaw);
@@ -1058,12 +1335,11 @@ async function cmdSubmit(flags, deps = {}) {
     body.publish_now = true;
   }
 
-  const registry = getRegistryUrl(flags);
   const result = await requestJsonImpl(`${registry}/api/skills/submit`, {
     method: "POST",
-    headers: {
+    headers: withBearerToken({
       "content-type": "application/json",
-    },
+    }, token),
     body: JSON.stringify(body),
   });
   log(JSON.stringify(result, null, 2));
@@ -1096,6 +1372,14 @@ async function main(argv = process.argv) {
     await cmdSearch(flags);
     return;
   }
+  if (command === "login") {
+    await cmdLogin(flags);
+    return;
+  }
+  if (command === "publish") {
+    await cmdPublish(flags);
+    return;
+  }
   if (command === "install") {
     await cmdInstall(flags);
     return;
@@ -1125,11 +1409,14 @@ module.exports = {
   normalizeSkillSpecs,
   normalizeInlineText,
   printFallbackSearchIntro,
+  getConfigPath,
   normalizeToolIds,
   parseInstallSelection,
   getAvailableInstallTargets,
   resolveInstallTargets,
   fetchResolvedVersion,
+  cmdLogin,
+  cmdPublish,
   cmdInstall,
   cmdAdd,
   cmdSearch,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ht-skills",
-  "version": "0.1.7",
+  "version": "0.2.0",
   "description": "CLI for installing and submitting skills from HT Skills Marketplace.",
   "type": "commonjs",
   "bin": {
@@ -16,6 +16,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.1.0",
+    "adm-zip": "^0.5.16",
     "picocolors": "^1.1.1"
   }
 }