huhaa-myskills 0.1.9 → 0.2.3

package/README.md

@@ -182,10 +182,10 @@ npm install
 npm start
 ```
 
-### 方式 C：npm 全局安装（不含编辑器同步）
+### 方式 C：npm 全局安装（推荐）
 
 ```bash
-npm install -g github:aquarkgn/HuHaa-MySkills
+npm install -g huhaa-myskills
 huhaa-myskills init
 huhaa-myskills start
 ```

package/{service/bin → bin}/huhaa-myskills.mjs

@@ -1,35 +1,39 @@
 #!/usr/bin/env node
 // huhaa-myskills CLI
-//
-// Subcommands:
-//   start   — scan + start server + open browser
-//   scan    — scan only, dump IR JSON to stdout
-//   init    — write default sources.yaml to ~/.config/huhaa-myskills/
-//   purge   — delete ~/.config/huhaa-myskills/ (zero-residue uninstall helper)
-//   dev     — dev mode (P3+ wires Vite + nodemon)
-//
-// All user-side state lives under HUHAA_HOME (defaults to ~/.config/huhaa-myskills).
 
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
 
-import {
-  homeDir,
-  configFile,
-  cacheFile,
-  stateFile,
-  ensureHomeDir,
-  writeJson,
-} from './lib/paths.mjs';
-import { pickPort } from './lib/port.mjs';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-// bin/ -> service/ -> repo root
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-const SERVICE_ROOT = path.resolve(__dirname, '..');
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const REPO_ROOT = path.resolve(__dirname, '..');
+const PKGS_ROOT = path.join(REPO_ROOT, 'packages');
 
+const require = createRequire(import.meta.url);
+
+// Load paths helper
+const pathsLib = require('./lib/paths.mjs');
+const { homeDir, configFile, cacheFile, stateFile, ensureHomeDir, writeJson } = pathsLib;
+
+// Load port helper
+const { pickPort } = require('./lib/port.mjs');
+
+// Load version from package.json
+function getVersion() {
+  try {
+    const pkgPath = path.join(REPO_ROOT, 'package.json');
+    const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+    return pkg.version;
+  } catch {
+    return 'unknown';
+  }
+}
+
+const VERSION = getVersion();
 const cmd = process.argv[2] || 'start';
 
 const handlers = {
@@ -40,9 +44,13 @@ const handlers = {
   init: cmdInit,
   purge: cmdPurge,
   dev: cmdDev,
+  sync: cmdSync,
   help: cmdHelp,
   '--help': cmdHelp,
   '-h': cmdHelp,
+  '--version': cmdVersion,
+  '-v': cmdVersion,
+  version: cmdVersion,
 };
 
 const fn = handlers[cmd] || cmdHelp;
@@ -51,13 +59,17 @@ fn().catch(err => {
   process.exit(1);
 });
 
-// ---------------- handlers ----------------
+// ---------------- commands ----------------
+
+async function cmdVersion() {
+  console.log(`huhaa-myskills v${VERSION}`);
+}
 
 async function cmdHelp() {
-  console.log(`huhaa-myskills — local skill / plugin / MCP aggregation hub
+  console.log(`huhaa-myskills v${VERSION} — local skill / plugin / MCP aggregation hub
 
 Usage:
-  huhaa-myskills <command>
+  huhaa-myskills <command> [options]
 
 Commands:
   start     Scan + start server + open browser (default)
@@ -66,12 +78,17 @@ Commands:
   duplicates Scan + print duplicate diagnostics by name/content/path
   init      Write default sources.yaml to ~/.config/huhaa-myskills/
   purge     Remove all user data under ~/.config/huhaa-myskills/
+  sync      Sync current skills to selected editors
   dev       Dev mode (Vite + nodemon)
-  help      Show this message
+
+Options:
+  -v, --version  Show version
+  -h, --help     Show this message
 
 Env:
   HUHAA_HOME      override user data dir (default: ~/.config/huhaa-myskills)
   PORT            override preferred port (default: 11520, falls back +10)
+  HUHAA_SYNC      comma-separated list of editors to sync (e.g. "cursor,vscode")
 
 Paths:
   config   ${configFile()}
@@ -88,7 +105,7 @@ async function cmdInit() {
     console.log('[init] not overwriting. delete it first if you want to reset.');
     return;
   }
-  const tpl = path.join(SERVICE_ROOT, 'config', 'sources.example.yaml');
+  const tpl = path.join(REPO_ROOT, 'config', 'sources.example.yaml');
   fs.copyFileSync(tpl, dst);
   console.log(`[init] wrote ${dst}`);
   console.log('[init] edit it to add / remove sources, then run: huhaa-myskills start');
@@ -106,8 +123,7 @@ async function cmdPurge() {
 }
 
 async function cmdScan() {
-  // P0 placeholder. P1 wires real adapters.
-  const { scan } = await import('@huhaa/scanner');
+  const { scan } = await import(path.join(PKGS_ROOT, 'scanner/src/index.mjs'));
   await ensureConfigOrInit();
   const items = await scan();
   process.stdout.write(JSON.stringify(items, null, 2) + '\n');
@@ -115,7 +131,7 @@ async function cmdScan() {
 }
 
 async function cmdStats() {
-  const { scan } = await import('@huhaa/scanner');
+  const { scan } = await import(path.join(PKGS_ROOT, 'scanner/src/index.mjs'));
   await ensureConfigOrInit();
   const items = await scan();
 
@@ -178,7 +194,6 @@ async function cmdStats() {
     }
   }
 
-  // deterministic-ish sample: every Nth item so coverage spans both sources
   const sampleN = Math.min(8, items.length);
   if (sampleN > 0) {
     const step = Math.max(1, Math.floor(items.length / sampleN));
@@ -200,7 +215,7 @@ async function cmdStats() {
 }
 
 async function cmdDuplicates() {
-  const { scan } = await import('@huhaa/scanner');
+  const { scan } = await import(path.join(PKGS_ROOT, 'scanner/src/index.mjs'));
   await ensureConfigOrInit();
   const items = await scan();
   const byName = groupBy(items, it => `${it.source}:${it.name}`);
@@ -263,20 +278,17 @@ async function cmdStart() {
     console.error(`[start] port ${preferred} busy, using ${port} instead.`);
   }
 
-  // Persist actual port for any tooling that wants to know.
   writeJson(stateFile(), { port, pid: process.pid, startedAt: new Date().toISOString() });
 
-  const { startServer } = await import('@huhaa/server');
+  const { startServer } = await import(path.join(PKGS_ROOT, 'server/src/index.mjs'));
   await startServer({ port });
 
   console.log(`\n  HuHaa-MySkills running:  http://localhost:${port}\n`);
   console.log(`  data dir: ${homeDir()}`);
   console.log(`  Ctrl+C to stop.\n`);
 
-  // Auto-open browser on macOS / linux / win
   openBrowser(`http://localhost:${port}`);
 
-  // Cleanup state file on exit so a stale port number doesn't linger.
   const cleanup = () => {
     try { fs.unlinkSync(stateFile()); } catch {}
     process.exit(0);
@@ -286,11 +298,77 @@ async function cmdStart() {
 }
 
 async function cmdDev() {
-  // P3+ wires Vite + nodemon. For now alias to start.
   console.log('[dev] dev mode comes in P3. running start for now.');
   await cmdStart();
 }
 
+async function cmdSync() {
+  const syncEnv = process.env.HUHAA_SYNC;
+  const editors = syncEnv
+    ? syncEnv.split(',').map(e => e.trim().toLowerCase())
+    : null;
+
+  const { scan } = await import(path.join(PKGS_ROOT, 'scanner/src/index.mjs'));
+  await ensureConfigOrInit();
+  const items = await scan();
+
+  const skills = items.filter(it => it.raw && it.raw.trim());
+
+  console.log(`[sync] found ${skills.length} skills to sync`);
+
+  if (editors) {
+    console.log(`[sync] syncing to editors: ${editors.join(', ')}`);
+    await syncToEditors(skills, editors);
+  } else {
+    await interactiveSync(skills);
+  }
+}
+
+async function syncToEditors(skills, editors) {
+  const supported = ['cursor', 'vscode', 'windsurf', 'zed', 'neovim', 'helix', 'sublime', 'vim', 'emacs'];
+  const validEditors = editors.filter(e => supported.includes(e));
+
+  if (validEditors.length === 0) {
+    console.error(`[sync] no valid editors. Supported: ${supported.join(', ')}`);
+    return;
+  }
+
+  for (const editor of validEditors) {
+    await syncToEditor(skills, editor);
+  }
+}
+
+async function syncToEditor(skills, editor) {
+  console.log(`[sync] syncing ${skills.length} skills to ${editor}...`);
+
+  const syncScript = path.join(REPO_ROOT, 'scripts', 'sync-skills.sh');
+
+  return new Promise((resolve) => {
+    const child = spawn('bash', [syncScript, '--editor', editor], {
+      stdio: ['pipe', 'inherit', 'inherit']
+    });
+
+    child.on('close', (code) => {
+      if (code === 0) {
+        console.log(`[sync] ${editor}: done`);
+      } else {
+        console.error(`[sync] ${editor}: failed (exit ${code})`);
+      }
+      resolve();
+    });
+  });
+}
+
+async function interactiveSync(skills) {
+  console.log('\nSupported editors:');
+  console.log('  [1] cursor      [2] vscode     [3] windsurf');
+  console.log('  [4] zed        [5] neovim     [6] helix');
+  console.log('  [7] sublime    [8] vim        [9] emacs');
+  console.log('  [0] all editors');
+  console.log('\nUse HUHAA_SYNC env to sync without prompt:');
+  console.log('  HUHAA_SYNC=cursor,vscode huhaa-myskills sync');
+}
+
 // ---------------- helpers ----------------
 
 async function ensureConfigOrInit() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "huhaa-myskills",
-  "version": "0.1.9",
+  "version": "0.2.3",
   "private": false,
   "description": "Local skill / plugin / MCP aggregation hub. Browse all your AI agent skills at http://localhost:11520.",
   "license": "MIT",
@@ -13,51 +13,42 @@
     "url": "https://github.com/aquarkgn/HuHaa-MySkills/issues"
   },
   "type": "module",
-  "workspaces": [
-    "service/packages/*"
-  ],
   "engines": {
     "node": ">=20.0.0"
   },
   "bin": {
-    "huhaa-myskills": "service/bin/huhaa-myskills.mjs"
+    "huhaa-myskills": "bin/huhaa-myskills.mjs"
   },
   "files": [
-    "service/bin/",
-    "service/config/",
-    "service/packages/scanner/src/",
-    "service/packages/server/src/",
-    "service/packages/web/dist/",
-    "service/scripts/",
+    "bin/",
+    "config/",
+    "packages/",
+    "scripts/",
     "docs/",
     "README.md",
-    "LICENSE",
-    "install-and-sync.sh"
+    "LICENSE"
   ],
   "scripts": {
-    "start": "node service/bin/huhaa-myskills.mjs start",
-    "scan": "node service/bin/huhaa-myskills.mjs scan",
-    "stats": "node service/bin/huhaa-myskills.mjs stats",
-    "duplicates": "node service/bin/huhaa-myskills.mjs duplicates",
-    "init": "node service/bin/huhaa-myskills.mjs init",
-    "purge": "node service/bin/huhaa-myskills.mjs purge",
-    "dev": "node service/bin/huhaa-myskills.mjs dev",
-    "sync": "bash service/scripts/sync-skills.sh",
-    "sync:remote": "curl -fsSL https://raw.githubusercontent.com/aquarkgn/HuHaa-MySkills/main/install-and-sync.sh | bash -s -- --sync-only",
-    "build:web": "node service/scripts/build-web.mjs",
-    "test": "node --test service/packages/scanner/test/*.test.mjs service/packages/server/test/*.test.mjs",
-    "verify": "node service/scripts/verify.mjs"
+    "start": "node bin/huhaa-myskills.mjs start",
+    "scan": "node bin/huhaa-myskills.mjs scan",
+    "stats": "node bin/huhaa-myskills.mjs stats",
+    "duplicates": "node bin/huhaa-myskills.mjs duplicates",
+    "init": "node bin/huhaa-myskills.mjs init",
+    "purge": "node bin/huhaa-myskills.mjs purge",
+    "dev": "node bin/huhaa-myskills.mjs dev",
+    "sync": "bash scripts/sync-skills.sh",
+    "build:web": "node scripts/build-web.mjs",
+    "test": "node --test packages/scanner/test/*.test.mjs packages/server/test/*.test.mjs",
+    "verify": "node scripts/verify.mjs",
+    "release": "npm version patch && git push --follow-tags"
   },
   "dependencies": {
-    "@huhaa/scanner": "file:service/packages/scanner",
-    "@huhaa/server": "file:service/packages/server",
     "chokidar": "^4.0.3",
     "fast-glob": "^3.3.2",
     "fastify": "^5.0.0",
     "yaml": "^2.6.0"
   },
   "devDependencies": {
-    "@huhaa/web": "file:service/packages/web",
     "@vitejs/plugin-vue": "^5.2.1",
     "fuse.js": "^7.0.0",
     "markdown-it": "^14.1.0",

package/packages/scanner/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "@huhaa/scanner",
+  "version": "0.1.1",
+  "private": true,
+  "type": "module",
+  "main": "./src/index.mjs",
+  "exports": {
+    ".": "./src/index.mjs",
+    "./types": "./src/types.d.ts"
+  },
+  "dependencies": {
+    "yaml": "^2.6.0",
+    "fast-glob": "^3.3.2"
+  }
+}

package/packages/scanner/test/scanner.test.mjs

@@ -0,0 +1,140 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+
+import { scan, getWatchTargets } from '../src/index.mjs';
+
+function makeTempHome() {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'huhaa-scanner-test-'));
+  const home = path.join(root, 'home');
+  fs.mkdirSync(home, { recursive: true });
+  process.env.HUHAA_HOME = home;
+  return { root, home };
+}
+
+function write(file, text) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, text);
+}
+
+function groupBy(items, fn) {
+  return items.reduce((acc, item) => {
+    const key = fn(item);
+    (acc[key] ||= []).push(item);
+    return acc;
+  }, {});
+}
+
+test('scan aggregates enabled sources, strips duplicate semantic skill exports, and redacts MCP secrets', async (t) => {
+  const { root, home } = makeTempHome();
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+
+  const sources = path.join(home, 'sources.yaml');
+  const hermesRoot = path.join(root, 'hermes-skills');
+  const codexRoot = path.join(root, 'project-a');
+  const cursorRoot = path.join(root, 'project-b');
+  const mcpFile = path.join(root, 'mcp.json');
+
+  write(path.join(hermesRoot, 'devops', 'deploy-helper', 'SKILL.md'), `---
+name: deploy-helper
+description: Deploy helper for Docker services
+triggers:
+  - deploy service
+---
+# Deploy helper
+Use this when deploying Docker services.
+`);
+  write(path.join(hermesRoot, '.hidden-export', 'deploy-helper', 'SKILL.md'), `---
+name: deploy-helper
+description: Duplicate hidden export
+---
+# Duplicate hidden export
+`);
+  write(path.join(codexRoot, 'AGENTS.md'), '# Codex Instructions\n\nUse Node 20 and run tests.');
+  write(path.join(cursorRoot, '.cursorrules'), 'Always keep UI concise.');
+  write(mcpFile, JSON.stringify({
+    mcpServers: {
+      dangerous: {
+        command: 'node',
+        args: ['server.js'],
+        env: {
+          API_TOKEN: 'fake-token-value-for-redaction-test',
+          normal: 'visible',
+        },
+        url: 'https://example.com/mcp?token=secret-value',
+      },
+    },
+  }, null, 2));
+
+  write(sources, `sources:
+  hermes:
+    enabled: true
+    roots:
+      - ${JSON.stringify(hermesRoot)}
+  codex:
+    enabled: true
+    roots:
+      - ${JSON.stringify(codexRoot)}
+  cursor:
+    enabled: true
+    roots:
+      - ${JSON.stringify(cursorRoot)}
+  mcp-config:
+    enabled: true
+    files:
+      - ${JSON.stringify(mcpFile)}
+limits:
+  maxFiles: 100
+  maxFileBytes: 1048576
+`);
+
+  const items = await scan();
+  const bySource = groupBy(items, it => it.source);
+
+  assert.equal(bySource.hermes?.length, 1, 'semantic duplicate hermes skill should collapse to one item');
+  assert.equal(bySource.codex?.length, 1);
+  assert.equal(bySource.cursor?.length, 1);
+  assert.equal(bySource['mcp-config']?.length, 1);
+
+  const skill = bySource.hermes[0];
+  assert.equal(skill.name, 'deploy-helper');
+  assert.equal(skill.editor, 'Hermes Agent');
+  assert.equal(skill.category, 'devops');
+  assert.deepEqual(skill.triggers, ['deploy service']);
+  assert.ok(!skill.paths.abs.includes('/.hidden-export/'), 'visible export should outrank hidden duplicate');
+
+  const mcp = bySource['mcp-config'][0];
+  assert.equal(mcp.kind, 'mcp');
+  assert.equal(mcp.name, 'dangerous');
+  assert.match(mcp.raw, /\[REDACTED\]/);
+  assert.doesNotMatch(mcp.raw, /fake-token-value-for-redaction-test/);
+  assert.doesNotMatch(mcp.raw, /secret-value/);
+  assert.match(mcp.raw, /visible/);
+});
+
+test('getWatchTargets includes config file plus configured source files and globs', async (t) => {
+  const { root, home } = makeTempHome();
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+
+  const hermesRoot = path.join(root, 'skills');
+  const mcpFile = path.join(root, 'mcp.json');
+  fs.mkdirSync(hermesRoot, { recursive: true });
+  write(mcpFile, '{}');
+  write(path.join(home, 'sources.yaml'), `sources:
+  hermes:
+    enabled: true
+    roots:
+      - ${JSON.stringify(hermesRoot)}
+  mcp-config:
+    enabled: true
+    files:
+      - ${JSON.stringify(mcpFile)}
+`);
+
+  const targets = await getWatchTargets();
+  assert.ok(targets.includes(path.join(home, 'sources.yaml')));
+  assert.ok(targets.includes(mcpFile));
+  assert.ok(targets.some(t => t.endsWith('/skills/**/SKILL.md')));
+});

package/packages/server/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "@huhaa/server",
+  "version": "0.1.1",
+  "private": true,
+  "type": "module",
+  "main": "./src/index.mjs",
+  "exports": {
+    ".": "./src/index.mjs"
+  },
+  "dependencies": {
+    "fastify": "^5.0.0",
+    "chokidar": "^4.0.3",
+    "@huhaa/scanner": "*"
+  }
+}

package/{service/packages → packages}/server/src/index.mjs

@@ -1,37 +1,22 @@
 // @huhaa/server — Fastify HTTP API + placeholder UI.
-//
-// Hard rules (locked from day 1):
-//   - bind 127.0.0.1 ONLY, never 0.0.0.0
-//   - server NEVER scans files; it reads in-memory IR populated by scanner
-//   - copy/open ONLY operate on paths that exist in the loaded IR snapshot
-//     (whitelist defense: a malicious request can't ask us to pbcopy / open
-//     arbitrary files because we resolve via skill id, not via raw path)
-//
-// API surface (P2):
-//   GET  /api/health            — liveness + counts
-//   GET  /api/skills            — list (no `raw` field — detail-only)
-//   GET  /api/skills/:id        — full IR item (with raw)
-//   GET  /api/stats             — by source / category / brand aggregates
-//   POST /api/copy              — { id, what: 'path'|'dir'|'rel'|'name'|'raw'|'prompt' } -> pbcopy
-//   POST /api/open              — { id, with?: 'cursor'|'finder'|'default' }
-//
-// P3 replaces the placeholder HTML with a built Vue SPA mounted at /.
-
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { spawn } from 'node:child_process';
 import Fastify from 'fastify';
 import chokidar from 'chokidar';
-import { scan, getWatchTargets } from '@huhaa/scanner';
 
 const PHASE = 'P6';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
-// server/src -> server -> packages -> service
-const SERVICE_ROOT = path.resolve(__dirname, '..', '..', '..');
-const PACKAGE_JSON = path.resolve(SERVICE_ROOT, '..', 'package.json');
+const PKGS_ROOT = path.resolve(__dirname, '..', '..');
+const PACKAGE_JSON = path.resolve(PKGS_ROOT, '..', 'package.json');
 const VERSION = readPackageVersion();
-const WEB_DIST = path.join(SERVICE_ROOT, 'packages', 'web', 'dist');
+const WEB_DIST = path.join(PKGS_ROOT, 'web', 'dist');
+
+async function importScanner() {
+  const { scan, getWatchTargets } = await import(path.join(PKGS_ROOT, 'scanner/src/index.mjs'));
+  return { scan, getWatchTargets };
+}
 
 function readPackageVersion() {
   try {
@@ -46,6 +31,8 @@ export async function startServer({ port = 11520 } = {}) {
     logger: { level: process.env.LOG_LEVEL || 'warn' },
   });
 
+  const { scan, getWatchTargets } = await importScanner();
+
   // In-memory IR. HTTP handlers only read this snapshot; reload/watch swaps it atomically.
   let irCache = await scan();
   let irById = new Map(irCache.map(it => [it.id, it]));