mdpush 1.1.0 → 1.1.1

package/README.md

@@ -1,6 +1,6 @@
 # mdpush
 
-Push markdown files to [Preview Reader](https://github.com/sielay/preview-reader) from your terminal.
+Push markdown files to [sielay](https://github.com/emiliovos/sielay) from your terminal.
 
 ## Install
 
@@ -123,7 +123,7 @@ Generate tokens from the web UI: **Sidebar > API Tokens > Generate Token**.
 ## Requirements
 
 - Node.js >= 18
-- A running [Preview Reader](https://github.com/sielay/preview-reader) server
+- A running [sielay](https://github.com/emiliovos/sielay) server
 
 ## License
 

package/assets/SKILL.md

@@ -138,3 +138,4 @@ Two viable shapes — decide at implementation time:
 Phase 1 CSP whitelist covers ~95% of artifacts that current Claude/agent workflows generate, with 0s author overhead. The 5–30x size penalty of full inlining is wasted bandwidth for the typical case. Document as roadmap; ship only when compliance or airgap demand surfaces.
 
 **Reference**: `plans/260512-1704-html-fidelity-render-as-original/plan.md` — Option D row in the trade-off table that informed this deferral decision.
+

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mdpush",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "type": "module",
   "engines": {
     "node": ">=20.0.0"
@@ -8,6 +8,16 @@
   "bin": {
     "mdpush": "./bin/mdpush.js"
   },
+  "files": [
+    "bin/",
+    "src/",
+    "assets/",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "prepublishOnly": "bash ./scripts/sync-skill-assets.sh"
+  },
   "dependencies": {
     "commander": "^12.0.0",
     "chalk": "^5.3.0",

package/src/commands/login-command.js

@@ -2,7 +2,7 @@ import chalk from 'chalk'
 import prompts from 'prompts'
 import { writeConfig } from '../lib/config-store.js'
 
-/** Login to Preview Reader server — prompts credentials, stores API token */
+/** Login to sielay server — prompts credentials, stores API token */
 export async function loginCommand(options) {
   const server = options.server.replace(/\/$/, '')
 
@@ -29,14 +29,19 @@ export async function loginCommand(options) {
       throw new Error(err.error || `Login failed (${loginRes.status})`)
     }
 
-    const { token: jwt } = await loginRes.json()
+    // The login body intentionally carries no JWT (audit LOW — httpOnly cookie
+    // only), so relay the session cookie to mint the revocable API token.
+    const jwtCookie = (loginRes.headers.getSetCookie?.() || [])
+      .map(c => c.split(';')[0])
+      .find(c => c.startsWith('jwt='))
+    if (!jwtCookie) throw new Error('Login succeeded but no session cookie received')
 
     // Step 2: Generate API token for CLI
     const tokenRes = await fetch(`${server}/api/auth/tokens`, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        'Authorization': `Bearer ${jwt}`
+        'Cookie': jwtCookie
       },
       body: JSON.stringify({ name: 'mdpush-cli' })
     })

package/src/commands/push-command.js

@@ -8,6 +8,7 @@ import { readConfig } from '../lib/config-store.js'
 const HTML_TYPE_WHITELIST = new Set(['spec', 'review', 'design', 'report', 'playground'])
 
 const isHtml = (f) => /\.html$/i.test(f)
+const isPdf = (f) => /\.pdf$/i.test(f)
 const isMdTxt = (f) => /\.(md|txt)$/i.test(f)
 
 /** Push markdown, text, and HTML artifact files to a project */
@@ -28,19 +29,21 @@ export async function pushCommand(files, options) {
       continue
     }
     if (stat.isDirectory()) {
+      // Directory expansion stays md/txt-only — don't sweep up large binaries
+      // (HTML/PDF) implicitly; pass those as explicit file args.
       const dirFiles = fs.readdirSync(f, { recursive: true })
         .filter(name => isMdTxt(name))
         .map(name => path.join(f, name))
       resolvedFiles.push(...dirFiles)
-    } else if (isMdTxt(f) || isHtml(f)) {
+    } else if (isMdTxt(f) || isHtml(f) || isPdf(f)) {
       resolvedFiles.push(f)
     } else {
-      console.log(chalk.yellow(`Skipping: ${f} (not .md, .txt, or .html)`))
+      console.log(chalk.yellow(`Skipping: ${f} (not .md, .txt, .html, or .pdf)`))
     }
   }
 
   if (resolvedFiles.length === 0) {
-    console.log(chalk.red('No .md, .txt, or .html files to upload.'))
+    console.log(chalk.red('No .md, .txt, .html, or .pdf files to upload.'))
     process.exit(1)
   }
 
@@ -67,10 +70,14 @@ export async function pushCommand(files, options) {
       formData.append('files', new Blob([content]), basename)
 
       const html = isHtml(filePath)
+      const pdf = isPdf(filePath)
       const params = new URLSearchParams()
       if (html) {
         params.set('contentType', 'html')
         if (type) params.set('type', type)
+      } else if (pdf) {
+        params.set('contentType', 'pdf')
+        if (folder) params.set('folder', folder)
       } else if (folder) {
         params.set('folder', folder)
       }
@@ -103,10 +110,10 @@ export async function pushCommand(files, options) {
       if (f.url) {
         // HTML artifact: server emits viewer URL
         const badge = f.type ? chalk.magenta(`[${f.type}] `) : ''
-        console.log(chalk.cyan(`🔗 ${badge}${f.url}  ${f.name}`))
+        console.log(chalk.cyan(`-> ${badge}${f.url}  ${f.name}`))
       } else {
         // md/txt: legacy /p/<slug>/f/<sid> path
-        console.log(chalk.cyan(`🔗 ${config.server}/p/${project}/f/${f.sid}  ${f.name}`))
+        console.log(chalk.cyan(`-> ${config.server}/p/${project}/f/${f.sid}  ${f.name}`))
       }
     }
   }

package/src/commands/skill-command.js

@@ -0,0 +1,124 @@
+import fs from 'fs'
+import path from 'path'
+import os from 'os'
+import chalk from 'chalk'
+import ora from 'ora'
+import { apiRequest } from '../lib/api-request.js'
+
+/**
+ * `mdpush skill push <dir>` / `mdpush skill install <slug>` — publish a Claude
+ * Code skill bundle to sielay (project kind='skill') and pull one back down
+ * into ~/.claude/skills/. Server counterpart: GET /api/skills(+/:slug/manifest).
+ */
+
+// Mirrors the server's TEXT_UPLOAD_EXTENSIONS (upload-middleware.js)
+const SKILL_FILE_EXTENSIONS = new Set(['.md', '.txt', '.py', '.sh', '.js', '.mjs', '.cjs', '.ps1', '.json', '.yaml', '.yml'])
+
+/** Recursive walk: relative POSIX paths, dotfiles + node_modules skipped. */
+function walkSkillDir(root, rel = '') {
+  const out = []
+  for (const e of fs.readdirSync(path.join(root, rel), { withFileTypes: true })) {
+    if (e.name.startsWith('.') || e.name === 'node_modules') continue
+    const relPath = rel ? `${rel}/${e.name}` : e.name
+    if (e.isDirectory()) out.push(...walkSkillDir(root, relPath))
+    else if (e.isFile() && SKILL_FILE_EXTENSIONS.has(path.extname(e.name).toLowerCase())) out.push(relPath)
+  }
+  return out
+}
+
+/** Push a local skill directory to the server as a kind='skill' project. */
+export async function skillPushCommand(dir, options) {
+  const root = path.resolve(dir)
+  if (!fs.existsSync(path.join(root, 'SKILL.md'))) {
+    console.log(chalk.red(`No SKILL.md in ${root} — not a skill directory.`))
+    process.exit(2)
+  }
+
+  const slug = options.project || path.basename(root).toLowerCase().replace(/[^a-z0-9-]+/g, '-')
+  const files = walkSkillDir(root)
+  if (!files.includes('SKILL.md')) files.unshift('SKILL.md')
+
+  // Ensure the skill project exists (idempotent: reuse when slug matches)
+  const listRes = await apiRequest('/api/projects')
+  const projects = await listRes.json()
+  let project = projects.find(p => p.slug === slug)
+  if (project && project.kind !== 'skill') {
+    console.log(chalk.red(`Project "${slug}" exists but is kind='${project.kind}', not a skill. Aborting.`))
+    process.exit(2)
+  }
+  if (!project) {
+    const createRes = await apiRequest('/api/projects', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name: slug, kind: 'skill' })
+    })
+    project = await createRes.json()
+    console.log(chalk.blue(`Created skill project "${project.slug}"`))
+  }
+
+  console.log(chalk.blue(`Pushing ${files.length} file(s) to skill "${project.slug}"...`))
+  let success = 0, failed = 0
+  for (const relPath of files) {
+    const spinner = ora(relPath).start()
+    try {
+      const formData = new FormData()
+      formData.append('files', new Blob([fs.readFileSync(path.join(root, relPath))]), path.basename(relPath))
+      const folder = path.dirname(relPath)
+      const query = folder && folder !== '.' ? `?folder=${encodeURIComponent(folder)}` : ''
+      await apiRequest(`/api/projects/${project.slug}/upload${query}`, {
+        method: 'POST',
+        headers: { 'X-Requested-With': 'XMLHttpRequest' },
+        body: formData
+      })
+      spinner.succeed(chalk.green(relPath))
+      success++
+    } catch (err) {
+      spinner.fail(chalk.red(`${relPath}: ${err.message}`))
+      failed++
+    }
+  }
+  console.log(`\n${chalk.green(`${success} pushed`)}${failed ? `, ${chalk.red(`${failed} failed`)}` : ''}`)
+  if (failed) process.exit(1)
+}
+
+/** Install a published skill into ~/.claude/skills/<slug> (or --dest). */
+export async function skillInstallCommand(slug, options) {
+  const manifestRes = await apiRequest(`/api/skills/${slug}/manifest`)
+  const manifest = await manifestRes.json()
+
+  const dest = path.resolve(options.dest || path.join(os.homedir(), '.claude', 'skills', slug))
+  console.log(chalk.blue(`Installing "${manifest.name || slug}" → ${dest} (${manifest.files.length} files)`))
+
+  let success = 0, failed = 0
+  for (const f of manifest.files) {
+    const spinner = ora(f.path).start()
+    try {
+      // Guard: manifest paths are server-generated, but never trust a path
+      // that would escape the destination directory.
+      const target = path.join(dest, f.path)
+      if (!target.startsWith(dest + path.sep)) throw new Error('Unsafe path in manifest')
+      const encoded = f.path.split('/').map(encodeURIComponent).join('/')
+      const res = await apiRequest(`/api/projects/${slug}/download/${encoded}`)
+      fs.mkdirSync(path.dirname(target), { recursive: true })
+      fs.writeFileSync(target, Buffer.from(await res.arrayBuffer()))
+      if (target.endsWith('.sh')) { try { fs.chmodSync(target, 0o755) } catch {} }
+      spinner.succeed(chalk.green(f.path))
+      success++
+    } catch (err) {
+      spinner.fail(chalk.red(`${f.path}: ${err.message}`))
+      failed++
+    }
+  }
+  console.log(`\n${chalk.green(`${success} installed`)}${failed ? `, ${chalk.red(`${failed} failed`)}` : ''}`)
+  if (failed) process.exit(1)
+}
+
+/** List published skills. */
+export async function skillListCommand() {
+  const res = await apiRequest('/api/skills')
+  const skills = await res.json()
+  if (skills.length === 0) return console.log(chalk.yellow('No skills published.'))
+  for (const s of skills) {
+    console.log(`${chalk.cyan(s.slug.padEnd(24))} ${s.description || chalk.gray('(no description)')}`)
+  }
+}

package/src/index.js

@@ -3,10 +3,11 @@ import { loginCommand } from './commands/login-command.js'
 import { pushCommand } from './commands/push-command.js'
 import { configCommand } from './commands/config-command.js'
 import { logoutCommand } from './commands/logout-command.js'
+import { skillPushCommand, skillInstallCommand, skillListCommand } from './commands/skill-command.js'
 
 program
   .name('mdpush')
-  .description('Push markdown, text, and HTML artifact files to Preview Reader')
+  .description('Push markdown, text, and HTML artifact files to sielay')
   .version('1.1.0')
 
 program.command('login')
@@ -22,6 +23,25 @@ program.command('push')
   .argument('<files...>', 'Files or directory to upload')
   .action(pushCommand)
 
+const skill = program.command('skill')
+  .description('Publish and install Claude Code skill bundles (projects with kind=skill)')
+
+skill.command('push')
+  .description('Push a skill directory (must contain SKILL.md) to the server')
+  .argument('<dir>', 'Skill directory')
+  .option('-p, --project <slug>', 'Project slug (default: directory name)')
+  .action(skillPushCommand)
+
+skill.command('install')
+  .description('Install a published skill into ~/.claude/skills/<slug>')
+  .argument('<slug>', 'Skill slug (see: mdpush skill list)')
+  .option('-d, --dest <path>', 'Destination directory (default: ~/.claude/skills/<slug>)')
+  .action(skillInstallCommand)
+
+skill.command('list')
+  .description('List skills published on the server')
+  .action(skillListCommand)
+
 program.command('config')
   .description('Show stored configuration')
   .action(configCommand)

package/src/lib/api-request.js

@@ -1,6 +1,6 @@
 import { readConfig } from './config-store.js'
 
-/** Make authenticated HTTP request to Preview Reader server */
+/** Make authenticated HTTP request to sielay server */
 export async function apiRequest(path, options = {}) {
   const config = readConfig()
   if (!config.server || !config.token) {