ppcos 1.2.0 → 1.2.2

package/lib/commands/init-all.js

@@ -4,17 +4,23 @@
  * Usage: ppcos init-all [--force]
  */
 
-import { existsSync } from 'node:fs';
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
 import { readFile, mkdir, rename } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
+import { tmpdir } from 'node:os';
 import { validateConfig } from '../utils/validation.js';
 import { calculateChecksum } from '../utils/checksum.js';
 import { createManifest, writeManifest, manifestExists, getManagedType, hubManifestExists } from '../utils/manifest.js';
-import { getAllFiles } from '../utils/fs-helpers.js';
+import { getAllFiles, copyFileWithDirs } from '../utils/fs-helpers.js';
 import { fetchSkills } from '../utils/skills-fetcher.js';
 import { installHubSkills } from './init.js';
 import logger from '../utils/logger.js';
-import { getPackageVersion, getPackageRoot, getClientsDir } from '../utils/paths.js';
+import ora from 'ora';
+import { getPackageVersion, getClientsDir } from '../utils/paths.js';
+
+// Top-level zip entries to skip when materializing a client folder.
+// hub-base/ is for hub-level skills; tmp/ holds runtime artifacts.
+const CLIENT_COPY_EXCLUDE_DIRS = new Set(['tmp', 'node_modules', 'hub-base']);
 
 /**
  * Get config file path
@@ -77,13 +83,14 @@ async function backupClient(clientDir) {
 }
 
 /**
- * Initialize a single client
+ * Initialize a single client by copying from a pre-extracted base template.
  * @param {string} clientName
  * @param {string} clientsDir
+ * @param {string} basePath - Directory holding the extracted skills zip
  * @param {object} options
  * @returns {Promise<{ status: 'initialized' | 'skipped' | 'failed', message?: string }>}
  */
-async function initializeClient(clientName, clientsDir, options = {}) {
+async function initializeClient(clientName, clientsDir, basePath, options = {}) {
   const clientDir = join(clientsDir, clientName);
   const version = getPackageVersion();
 
@@ -102,8 +109,15 @@ async function initializeClient(clientName, clientsDir, options = {}) {
   }
 
   try {
-    // Fetch skills from API
-    await fetchSkills(clientDir);
+    // Copy template files from the shared base to this client, skipping
+    // hub-base/ (hub-level skills, installed separately at the hub root).
+    const baseFiles = await getAllFiles(basePath, basePath, CLIENT_COPY_EXCLUDE_DIRS);
+
+    for (const relativePath of baseFiles) {
+      const srcPath = join(basePath, relativePath);
+      const destPath = join(clientDir, relativePath);
+      await copyFileWithDirs(srcPath, destPath);
+    }
 
     // Calculate checksums for all files in client dir
     const allFiles = await getAllFiles(clientDir);
@@ -168,46 +182,72 @@ export default async function initAll(options = {}) {
   console.log(`Found ${enabledClients.length} client${enabledClients.length === 1 ? '' : 's'} in main-config.json`);
   console.log('');
 
-  // 2. Process each client
-  const results = {
-    initialized: 0,
-    skipped: 0,
-    failed: 0
-  };
+  // 2. Download skills once into a shared temp dir, then copy locally
+  // per client. One API call serves N clients, avoiding rate limiting
+  // (API caps GET /api/skills at 10/hr per session).
+  const tempDir = mkdtempSync(join(tmpdir(), 'ppcos-init-all-'));
+  const spinner = ora('Downloading skills from API...').start();
+  try {
+    await fetchSkills(tempDir);
+    spinner.succeed('Skills downloaded');
+  } catch (error) {
+    spinner.fail('Failed to download skills');
+    logger.error(error.message);
+    if (error.message.includes('Not authenticated') || error.message.includes('401') || error.message.includes('expired')) {
+      logger.info('Try: ppcos login');
+    }
+    rmSync(tempDir, { recursive: true, force: true });
+    process.exitCode = 1;
+    return;
+  }
+
+  try {
+    // 3. Process each client
+    const results = {
+      initialized: 0,
+      skipped: 0,
+      failed: 0
+    };
 
-  for (const client of enabledClients) {
-    process.stdout.write(`Initializing ${client.name}... `);
+    for (const client of enabledClients) {
+      process.stdout.write(`Initializing ${client.name}... `);
 
-    const initResult = await initializeClient(client.name, clientsDir, options);
+      const initResult = await initializeClient(client.name, clientsDir, tempDir, options);
 
-    if (initResult.status === 'initialized') {
-      logger.success('');
-      results.initialized++;
-    } else if (initResult.status === 'skipped') {
-      console.log(`Skipped (${initResult.message})`);
-      results.skipped++;
-    } else {
-      logger.error(initResult.message || 'Unknown error');
-      results.failed++;
+      if (initResult.status === 'initialized') {
+        logger.success('');
+        results.initialized++;
+      } else if (initResult.status === 'skipped') {
+        console.log(`Skipped (${initResult.message})`);
+        results.skipped++;
+      } else {
+        logger.error(initResult.message || 'Unknown error');
+        results.failed++;
+      }
     }
-  }
 
-  // 3. Install hub skills if not already installed
-  const hubDir = process.cwd();
-  if (!hubManifestExists(hubDir)) {
-    const hubBasePath = join(getPackageRoot(), 'hub-base');
-    await installHubSkills(hubBasePath);
-  }
+    // 4. Install hub skills if not already installed.
+    // Use the hub-base/ extracted from the API zip — the published npm
+    // package only ships bin/ + lib/, so getPackageRoot()/hub-base doesn't
+    // exist for normal installs.
+    const hubDir = process.cwd();
+    if (!hubManifestExists(hubDir)) {
+      const hubBasePath = join(tempDir, 'hub-base');
+      await installHubSkills(hubBasePath);
+    }
 
-  // 4. Display summary
-  console.log('');
-  console.log('Summary:');
-  console.log(`  Initialized: ${results.initialized}`);
-  console.log(`  Skipped: ${results.skipped}`);
-  console.log(`  Failed: ${results.failed}`);
+    // 5. Display summary
+    console.log('');
+    console.log('Summary:');
+    console.log(`  Initialized: ${results.initialized}`);
+    console.log(`  Skipped: ${results.skipped}`);
+    console.log(`  Failed: ${results.failed}`);
 
-  if (results.failed > 0) {
-    process.exitCode = 1;
+    if (results.failed > 0) {
+      process.exitCode = 1;
+    }
+  } finally {
+    rmSync(tempDir, { recursive: true, force: true });
   }
 }
 

package/lib/commands/init.js

@@ -4,9 +4,10 @@
  * Usage: ppcos init <client-name> [--skip-config]
  */
 
-import { existsSync, rmSync } from 'node:fs';
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
 import { readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import { tmpdir } from 'node:os';
 import { validateClientName } from '../utils/validation.js';
 import { calculateChecksum } from '../utils/checksum.js';
 import { createManifest, writeManifest, manifestExists, getManagedType, hubManifestExists, writeHubManifest } from '../utils/manifest.js';
@@ -142,9 +143,42 @@ async function createConfigTemplate() {
 
   logger.success('Created main-config.json');
 
-  // Install hub skills
-  await installHubSkills(getHubBasePath());
+  // Install hub skills. The published npm package ships only bin/ + lib/,
+  // so hub-base/ doesn't exist next to the installed package — we fetch
+  // the API zip into a temp dir and use its hub-base/ subdirectory. Falls
+  // back to the local hub-base/ when running from a repo checkout (dev mode).
+  const tempDir = mkdtempSync(join(tmpdir(), 'ppcos-init-hub-'));
+  let hubBasePath;
+  const spinner = ora('Downloading hub skills...').start();
+  try {
+    await fetchSkills(tempDir);
+    spinner.succeed('Hub skills downloaded');
+    hubBasePath = join(tempDir, 'hub-base');
+  } catch (err) {
+    spinner.fail('Failed to download hub skills');
+    const localHubBase = getHubBasePath();
+    if (existsSync(localHubBase)) {
+      logger.warn('Using local hub-base/ (dev mode)');
+      hubBasePath = localHubBase;
+    } else {
+      logger.error(err.message);
+      logger.error('Hub skills not installed. Run: ppcos login, then ppcos init-all');
+      rmSync(tempDir, { recursive: true, force: true });
+      printNextSteps();
+      return;
+    }
+  }
+
+  try {
+    await installHubSkills(hubBasePath);
+  } finally {
+    rmSync(tempDir, { recursive: true, force: true });
+  }
+
+  printNextSteps();
+}
 
+function printNextSteps() {
   console.log('');
   console.log('Next steps:');
   console.log('  1. Edit main-config.json with your client names');
@@ -193,7 +227,7 @@ export default async function init(clientName, options = {}) {
   // 3. Fetch skills from API (with local fallback for dev/testing)
   const spinner = ora('Fetching skills from API...').start();
   try {
-    await fetchSkills(clientDir);
+    await fetchSkills(clientDir, { excludeTopLevel: ['hub-base'] });
     spinner.succeed('Skills downloaded');
   } catch (error) {
     spinner.fail('Failed to fetch skills');

package/lib/commands/update.js

@@ -4,7 +4,7 @@
  * Usage: ppcos update [--client <name>] [--dry-run]
  */
 
-import { existsSync, unlinkSync } from 'node:fs';
+import { existsSync, unlinkSync, statSync, chmodSync } from 'node:fs';
 import { join, sep } from 'node:path';
 import {
   readManifest,
@@ -217,6 +217,27 @@ async function updateClient(clientName, basePathOrOptions = {}, options = {}) {
     }
   }
 
+  // Heal shell-hook exec bits across the full managed tree.
+  // Content-unchanged hooks are skipped by the checksum-driven copy loop above,
+  // so clients that updated before the skills-fetcher chmod fix kept 0644 hooks
+  // and Claude Code's stop hook fails with "Permission denied". This restores
+  // +x on any managed *.sh missing it. Idempotent; no-op on Windows.
+  if (process.platform !== 'win32') {
+    for (const relativePath of Object.keys(manifest.managedFiles)) {
+      if (!relativePath.endsWith('.sh')) continue;
+      const fullPath = join(clientDir, relativePath);
+      if (!existsSync(fullPath)) continue;
+      try {
+        const mode = statSync(fullPath).mode;
+        if ((mode & 0o111) !== 0o111) {
+          chmodSync(fullPath, mode | 0o755);
+        }
+      } catch {
+        // Don't fail update over a chmod hiccup
+      }
+    }
+  }
+
   // Update manifest
   manifest.baseVersion = packageVersion;
   manifest.lastUpdated = new Date().toISOString();

package/lib/utils/skills-fetcher.js

@@ -1,16 +1,22 @@
-import { existsSync, mkdirSync, writeFileSync, unlinkSync } from 'fs';
+import { existsSync, mkdirSync, writeFileSync, unlinkSync, chmodSync } from 'fs';
 import { Open } from 'unzipper';
-import { join } from 'path';
+import { join, dirname } from 'path';
 import { tmpdir } from 'os';
 import { downloadSkills } from './api-client.js';
 import { readAuth } from './auth.js';
+import { getAllFiles } from './fs-helpers.js';
 import logger from './logger.js';
 
 /**
  * Fetch skills from API and extract to target directory
  * @param {string} targetDir - Directory to extract skills into
+ * @param {object} [options]
+ * @param {string[]} [options.excludeTopLevel] - Top-level zip entry names to skip
+ *   (e.g. ['hub-base'] when extracting into a client folder — hub skills are
+ *   handled separately via update-hub.js).
  */
-export async function fetchSkills(targetDir) {
+export async function fetchSkills(targetDir, options = {}) {
+  const { excludeTopLevel } = options;
   const auth = readAuth();
 
   if (!auth?.sessionToken) {
@@ -35,7 +41,36 @@ export async function fetchSkills(targetDir) {
     writeFileSync(tempZip, buffer);
 
     const directory = await Open.file(tempZip);
-await directory.extract({ path: targetDir });
+
+    if (!excludeTopLevel || excludeTopLevel.length === 0) {
+      await directory.extract({ path: targetDir });
+    } else {
+      const excludeSet = new Set(excludeTopLevel);
+      for (const entry of directory.files) {
+        const top = entry.path.split('/')[0];
+        if (excludeSet.has(top)) {
+          continue;
+        }
+        const destPath = join(targetDir, entry.path);
+        if (entry.type === 'Directory') {
+          if (!existsSync(destPath)) mkdirSync(destPath, { recursive: true });
+        } else {
+          const parent = dirname(destPath);
+          if (!existsSync(parent)) mkdirSync(parent, { recursive: true });
+          const content = await entry.buffer();
+          writeFileSync(destPath, content);
+        }
+      }
+    }
+
+    // unzipper's extract() drops unix mode bits — restore +x on shell hooks
+    // so Claude Code can run them. No-op on Windows (chmod ignores mode bits).
+    const extracted = await getAllFiles(targetDir);
+    for (const rel of extracted) {
+      if (rel.endsWith('.sh')) {
+        try { chmodSync(join(targetDir, rel), 0o755); } catch {}
+      }
+    }
   } finally {
     try { unlinkSync(tempZip); } catch {}
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ppcos",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "CLI tool to manage Google Ads AI workflow skills and agents for Claude Code",
   "type": "module",
   "bin": {