lazy-skill 0.0.1 → 0.1.0

package/dist/lib/config.js

@@ -0,0 +1,70 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { DEFAULT_THEME, isThemeId } from "../ui/theme.js";
+const DIR = join(homedir(), ".lazyskill");
+const FILE = join(DIR, "config.json");
+const DEFAULTS = { theme: DEFAULT_THEME };
+export function configPath() {
+    return FILE;
+}
+export function readConfig() {
+    try {
+        if (!existsSync(FILE))
+            return { ...DEFAULTS };
+        const parsed = JSON.parse(readFileSync(FILE, "utf8"));
+        return {
+            ...DEFAULTS,
+            ...parsed,
+            // Never trust a hand-edited theme value into the rendering path.
+            theme: isThemeId(parsed.theme) ? parsed.theme : DEFAULT_THEME,
+        };
+    }
+    catch {
+        // A corrupt config should not brick the CLI; fall back to defaults.
+        return { ...DEFAULTS };
+    }
+}
+export function writeConfig(config) {
+    mkdirSync(DIR, { recursive: true, mode: 0o700 });
+    writeFileSync(FILE, JSON.stringify(config, null, 2) + "\n", { mode: 0o600 });
+    // mkdir/writeFile modes are subject to umask, so set them explicitly.
+    try {
+        chmodSync(DIR, 0o700);
+        chmodSync(FILE, 0o600);
+    }
+    catch {
+        // Windows has no POSIX modes; the file lives in the user profile anyway.
+    }
+}
+export function updateConfig(patch) {
+    const next = { ...readConfig(), ...patch };
+    writeConfig(next);
+    return next;
+}
+/** Forgets the device credential but keeps cosmetic preferences. */
+export function clearCredentials() {
+    const current = readConfig();
+    writeConfig({ theme: current.theme, apiUrl: current.apiUrl });
+}
+export function forgetEverything() {
+    try {
+        rmSync(FILE, { force: true });
+    }
+    catch {
+        // Nothing to forget.
+    }
+}
+/**
+ * Where the CLI pairs and polls by default.
+ *
+ * The deployment's own hostname, not a domain we do not own. A published CLI
+ * pointing at an unregistered domain would send every user's pairing attempt
+ * nowhere — or, worse, to whoever registers it later. Override with
+ * LAZY_SKILL_API_URL when running against a local server.
+ */
+export const DEFAULT_API_URL = "https://lazy-skill.vercel.app";
+export function apiBaseUrl() {
+    const configured = readConfig().apiUrl ?? process.env.LAZY_SKILL_API_URL;
+    return (configured || DEFAULT_API_URL).replace(/\/$/, "");
+}

package/dist/lib/job-contract.js

@@ -0,0 +1,74 @@
+/**
+ * The device's own copy of the command vocabulary.
+ *
+ * Duplicated from the server on purpose. A device must not depend on the
+ * server for its definition of what is safe to run: if the server is
+ * compromised, the only thing standing between it and the user's machine is
+ * this file. A test asserts the two copies stay identical.
+ */
+export const JOB_COMMANDS = [
+    "INSTALL_SKILL",
+    "CHECK_STATUS",
+    "LIST_SKILLS",
+    "DISCONNECT",
+];
+export const JOB_STAGES = [
+    "starting",
+    "downloading",
+    "installing",
+    "verifying",
+    "done",
+    "failed",
+];
+export const JOB_AGENTS = ["claude", "codex", "cursor"];
+export const SKILL_REF_PATTERN = /^[A-Za-z0-9_][A-Za-z0-9_-]*(?:\/[A-Za-z0-9_][A-Za-z0-9_.-]*){1,2}$/;
+export const MAX_SKILL_REF_LENGTH = 200;
+export class UnsafeJobError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UnsafeJobError";
+    }
+}
+export function isJobCommand(value) {
+    return typeof value === "string" && JOB_COMMANDS.includes(value);
+}
+export function isJobAgent(value) {
+    return typeof value === "string" && JOB_AGENTS.includes(value);
+}
+export function isValidSkillRef(value) {
+    return (typeof value === "string" &&
+        value.length > 0 &&
+        value.length <= MAX_SKILL_REF_LENGTH &&
+        SKILL_REF_PATTERN.test(value) &&
+        !value.includes(".."));
+}
+/**
+ * Validates a payload the server sent. Everything the server says is treated
+ * as a suggestion until it passes this.
+ */
+export function parseInstallPayload(input) {
+    const raw = (input ?? {});
+    if (!isValidSkillRef(raw.skillRef)) {
+        throw new UnsafeJobError("The server sent an invalid skill reference.");
+    }
+    if (!Array.isArray(raw.agents) || raw.agents.length === 0 || raw.agents.length > 6) {
+        throw new UnsafeJobError("The server sent no usable target agents.");
+    }
+    const agents = [];
+    for (const agent of raw.agents) {
+        if (!isJobAgent(agent)) {
+            throw new UnsafeJobError(`The server sent an unknown agent "${String(agent)}".`);
+        }
+        if (!agents.includes(agent))
+            agents.push(agent);
+    }
+    const skillName = typeof raw.skillName === "string" && raw.skillName.trim()
+        ? raw.skillName.trim().slice(0, 200)
+        : raw.skillRef;
+    return {
+        skillRef: raw.skillRef,
+        skillName,
+        agents,
+        scope: raw.scope === "project" ? "project" : "global",
+    };
+}

package/dist/ui/box.js

@@ -0,0 +1,56 @@
+import { rgb, style, visibleWidth } from "./theme.js";
+/**
+ * The framed card the CLI draws. Rounded corners and a themed border, to match
+ * the cards on the brand board.
+ */
+const B = {
+    tl: "╭", tr: "╮", bl: "╰", br: "╯", h: "─", v: "│",
+};
+export const CARD_WIDTH = 56;
+export function rule(theme, width = CARD_WIDTH) {
+    return rgb(theme.accent, B.h.repeat(width - 2));
+}
+export function top(theme, width = CARD_WIDTH) {
+    return rgb(theme.accent, B.tl + B.h.repeat(width - 2) + B.tr);
+}
+export function bottom(theme, width = CARD_WIDTH) {
+    return rgb(theme.accent, B.bl + B.h.repeat(width - 2) + B.br);
+}
+/** A content row, padded to the card width using visible (not raw) length. */
+export function row(theme, content = "", width = CARD_WIDTH) {
+    const inner = width - 4;
+    const pad = Math.max(0, inner - visibleWidth(content));
+    const edge = rgb(theme.accent, B.v);
+    return `${edge} ${content}${" ".repeat(pad)} ${edge}`;
+}
+export function centered(theme, content, width = CARD_WIDTH) {
+    const inner = width - 4;
+    const len = visibleWidth(content);
+    const left = Math.max(0, Math.floor((inner - len) / 2));
+    return row(theme, " ".repeat(left) + content, width);
+}
+/**
+ * The wordmark, in the same two-tone split the web app uses: LAZY in the
+ * terminal's default ink, SKILL in the theme accent.
+ */
+export function wordmark(theme) {
+    return [
+        `${style.bold("LAZY")} ${rgb(theme.accent, style.bold("SKILL"))}${rgb(theme.support, " Zz")}`,
+    ];
+}
+/** Bit, small enough to sit inside a card. */
+export function mascot(theme, awake = false) {
+    const hood = (t) => rgb(theme.accent, t);
+    const eyes = awake ? "o o" : "- -";
+    return [
+        hood("  ▄███▄  "),
+        hood(" █") + `\x1b[0m${eyes}` + hood("█ "),
+        hood(" █ ") + "‿" + hood(" █ "),
+        hood("  ▀███▀  "),
+    ];
+}
+export function statusLine(label, ok) {
+    const mark = ok === null ? style.gray("○") : ok ? style.green("✓") : style.gray("○");
+    const text = ok === null ? style.gray("Not detected") : ok ? style.green("Ready") : style.gray("Not detected");
+    return `${label.padEnd(12)} ${mark} ${text}`;
+}

package/dist/ui/messages.js

@@ -0,0 +1,38 @@
+/**
+ * The CLI's voice. Occasional and charming rather than constant (§9) — one
+ * joke per stage, not one per line, and never in place of information the
+ * user actually needs.
+ */
+function pick(list) {
+    return list[Math.floor(Math.random() * list.length)];
+}
+export const messages = {
+    booting: () => [
+        "initializing laziness.exe",
+        "searching for human...",
+    ],
+    humanFound: () => pick([
+        "human detected",
+        "checking if you're lazy...",
+        "found someone. good enough",
+    ]),
+    generating: () => "generating connection portal...",
+    waiting: () => pick([
+        "waiting for scan...",
+        "still waiting...",
+        "please scan before I fall asleep",
+    ]),
+    scanned: () => "PHONE DETECTED",
+    authenticating: () => pick([
+        "authenticating...",
+        "pretending this is complicated...",
+    ]),
+    connected: () => "YOU'RE CONNECTED",
+    signOff: () => pick([
+        "Now go be lazy.",
+        "Do less. Install more.",
+        "Your computer was doing nothing anyway.",
+    ]),
+    expired: () => "That QR took too long. It's asleep now.",
+    failed: () => "That didn't work. Even Lazy Skill gets tired sometimes.",
+};

package/dist/ui/qr.js

@@ -0,0 +1,59 @@
+import QRCode from "qrcode";
+/** The terminal renderer paints black modules on a white background. */
+const QR_OPEN = "\x1b[47m\x1b[30m";
+const QR_CLOSE = "\x1b[0m";
+/**
+ * Renders the pairing QR.
+ *
+ * Generated by a real encoder at error-correction level M. Nothing is drawn
+ * inside the module area and nothing is substituted for the code — scan
+ * reliability is not negotiable for decoration (§10).
+ *
+ * The quiet zone is added here rather than passed as an option: node-qrcode's
+ * terminal renderer ignores `margin` when `small` is set, and ships only a
+ * single module of padding. The standard wants four, and without it the finder
+ * patterns sit flush against surrounding terminal text, which measurably hurts
+ * scanning. Each rendered row is two modules tall (half-blocks), so two blank
+ * rows above and below give the four modules vertically, and three extra
+ * columns each side top up the one already present.
+ */
+export async function renderQr(url) {
+    const art = await QRCode.toString(url, {
+        type: "terminal",
+        small: true,
+        errorCorrectionLevel: "M",
+    });
+    const rows = art
+        .split("\n")
+        .filter((line) => stripAnsi(line).length > 0)
+        // Drop only the wrapper this renderer adds. Interior codes are left alone:
+        // the final half-row recolours per cell, and rewriting that would corrupt
+        // the modules themselves.
+        .map((line) => line.replace(new RegExp(`^${escapeRe(QR_OPEN)}`), "").replace(/\x1b\[0m$/, ""));
+    if (rows.length === 0)
+        return [];
+    const SIDE = 3;
+    // Width must be measured in visible cells: the last row carries per-cell
+    // escape sequences, and counting those would blow the quiet zone out to
+    // hundreds of columns.
+    const content = Math.max(...rows.map((row) => visibleLength(row)));
+    const width = content + SIDE * 2;
+    const blank = `${QR_OPEN}${" ".repeat(width)}${QR_CLOSE}`;
+    const padded = rows.map((row) => {
+        const trailing = " ".repeat(Math.max(0, content - visibleLength(row)));
+        return `${QR_OPEN}${" ".repeat(SIDE)}${row}${trailing}${" ".repeat(SIDE)}${QR_CLOSE}`;
+    });
+    return [blank, blank, ...padded, blank, blank];
+}
+// eslint-disable-next-line no-control-regex
+const ANSI = /\x1b\[[0-9;]*m/g;
+function stripAnsi(text) {
+    return text.replace(ANSI, "");
+}
+/** Visible cell count, ignoring escape sequences. */
+export function visibleLength(text) {
+    return stripAnsi(text).length;
+}
+function escapeRe(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}

package/dist/ui/spinner.js

@@ -0,0 +1,42 @@
+import { rgb, hasColor } from "./theme.js";
+const FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+/**
+ * A single-line spinner that cleans up after itself.
+ *
+ * Falls back to a plain printed line when stdout is not a TTY, so piping the
+ * CLI into a log does not produce thousands of redraw sequences.
+ */
+export class Spinner {
+    theme;
+    text;
+    timer = null;
+    frame = 0;
+    constructor(theme, text) {
+        this.theme = theme;
+        this.text = text;
+    }
+    start() {
+        if (!process.stdout.isTTY || !hasColor) {
+            process.stdout.write(`  ${this.text}\n`);
+            return this;
+        }
+        process.stdout.write("\x1b[?25l"); // hide cursor
+        this.timer = setInterval(() => {
+            const glyph = rgb(this.theme.accent, FRAMES[this.frame++ % FRAMES.length]);
+            process.stdout.write(`\r  ${glyph} ${this.text}\x1b[K`);
+        }, 80);
+        return this;
+    }
+    update(text) {
+        this.text = text;
+    }
+    stop(final) {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+            process.stdout.write("\r\x1b[K\x1b[?25h"); // clear line, show cursor
+        }
+        if (final)
+            process.stdout.write(`  ${final}\n`);
+    }
+}

package/dist/ui/theme.js

@@ -0,0 +1,73 @@
+/**
+ * CLI themes. Ids match the web app's exactly, so the theme chosen here can
+ * ride along in the pairing payload and the phone adopts the same look
+ * (§7/§53). The id is cosmetic and carries no authority.
+ */
+export const THEME_IDS = [
+    "cyber-purple",
+    "cyber-blue",
+    "matrix-green",
+    "sakura-pink",
+    "sunset-orange",
+    "teal-mint",
+    "monochrome",
+];
+export const DEFAULT_THEME = "cyber-purple";
+export const THEMES = {
+    "cyber-purple": { id: "cyber-purple", label: "Purple Night", accent: [168, 85, 247], support: [94, 234, 212] },
+    "cyber-blue": { id: "cyber-blue", label: "Cyber Blue", accent: [56, 189, 248], support: [167, 139, 250] },
+    "matrix-green": { id: "matrix-green", label: "Matrix Green", accent: [56, 224, 123], support: [103, 232, 249] },
+    "sakura-pink": { id: "sakura-pink", label: "Rose Pink", accent: [244, 114, 182], support: [196, 181, 253] },
+    "sunset-orange": { id: "sunset-orange", label: "Sunset Orange", accent: [251, 146, 60], support: [251, 191, 36] },
+    "teal-mint": { id: "teal-mint", label: "Teal Mint", accent: [45, 212, 191], support: [167, 139, 250] },
+    monochrome: { id: "monochrome", label: "Monochrome", accent: [228, 228, 236], support: [161, 161, 170] },
+};
+export function isThemeId(value) {
+    return typeof value === "string" && THEME_IDS.includes(value);
+}
+/**
+ * Colour support. NO_COLOR is honoured unconditionally, and a non-TTY (a pipe,
+ * a CI log) gets plain text — escape codes in a log file help nobody.
+ */
+function colorLevel() {
+    if (process.env.NO_COLOR)
+        return 0;
+    if (process.env.FORCE_COLOR === "0")
+        return 0;
+    if (process.env.FORCE_COLOR)
+        return 2;
+    if (!process.stdout.isTTY)
+        return 0;
+    if (process.env.COLORTERM === "truecolor" || process.env.COLORTERM === "24bit")
+        return 2;
+    if (process.env.TERM === "dumb")
+        return 0;
+    return 1;
+}
+const LEVEL = colorLevel();
+/** Nearest xterm-256 index, for terminals without truecolor. */
+function to256([r, g, b]) {
+    const q = (v) => Math.round((v / 255) * 5);
+    return 16 + 36 * q(r) + 6 * q(g) + q(b);
+}
+export function rgb(color, text) {
+    if (LEVEL === 0)
+        return text;
+    if (LEVEL === 1)
+        return `\x1b[38;5;${to256(color)}m${text}\x1b[0m`;
+    return `\x1b[38;2;${color[0]};${color[1]};${color[2]}m${text}\x1b[0m`;
+}
+export const style = {
+    dim: (t) => (LEVEL === 0 ? t : `\x1b[2m${t}\x1b[0m`),
+    bold: (t) => (LEVEL === 0 ? t : `\x1b[1m${t}\x1b[0m`),
+    green: (t) => (LEVEL === 0 ? t : `\x1b[32m${t}\x1b[0m`),
+    yellow: (t) => (LEVEL === 0 ? t : `\x1b[33m${t}\x1b[0m`),
+    red: (t) => (LEVEL === 0 ? t : `\x1b[31m${t}\x1b[0m`),
+    gray: (t) => (LEVEL === 0 ? t : `\x1b[90m${t}\x1b[0m`),
+};
+export const hasColor = LEVEL > 0;
+/** Visible width, ignoring escape codes, so box borders line up. */
+export function visibleWidth(text) {
+    // eslint-disable-next-line no-control-regex
+    return text.replace(/\x1b\[[0-9;]*m/g, "").length;
+}

package/package.json

@@ -1,20 +1,59 @@
 {
   "name": "lazy-skill",
-  "version": "0.0.1",
-  "description": "Lazy Skill — see it, search it, install it. Not released yet.",
-  "license": "MIT",
-  "author": "ketchupketchup",
+  "version": "0.1.0",
+  "description": "Found an AI skill while scrolling? Install it to your computer from your phone.",
+  "type": "module",
+  "bin": {
+    "lazy-skill": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch",
+    "start": "node dist/index.js",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "node test/qr.test.mjs && node test/install-plan.test.mjs && node test/stage.test.mjs",
+    "pretest": "tsc -p tsconfig.json",
+    "prepublishOnly": "rm -rf dist && tsc -p tsconfig.json"
+  },
   "keywords": [
     "ai",
     "skills",
+    "agent-skills",
     "claude",
+    "claude-code",
     "codex",
     "cursor",
-    "cli"
-  ],
-  "files": [
-    "README.md"
+    "cli",
+    "qr",
+    "developer-tools"
   ],
+  "license": "MIT",
+  "dependencies": {
+    "qrcode": "^1.5.4"
+  },
+  "devDependencies": {
+    "@types/node": "^20",
+    "@types/qrcode": "^1.5.5",
+    "typescript": "^5"
+  },
+  "homepage": "https://github.com/kashhhyuppp/lazy-skill#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kashhhyuppp/lazy-skill.git",
+    "directory": "cli"
+  },
+  "bugs": {
+    "url": "https://github.com/kashhhyuppp/lazy-skill/issues"
+  },
+  "author": "kashhhyuppp",
   "publishConfig": {
     "access": "public"
   }