promptgraph-mcp 2.4.6 → 2.4.8

package/index.js

@@ -16,7 +16,7 @@ const args = process.argv.slice(2);
 const rawBin = process.argv[1]?.split(/[\\/]/).pop()?.replace(/\.js$/, '');
 const bin = (rawBin && rawBin !== 'index') ? rawBin : 'pg';
 
-const KNOWN_COMMANDS = new Set(['init', 'reindex', 'update', 'import', 'setup', 'validate', 'marketplace', 'doctor', 'search', 'help', '--help', '-h', 'bundle', 'status']);
+const KNOWN_COMMANDS = new Set(['init', 'reindex', 'update', 'import', 'setup', 'validate', 'marketplace', 'doctor', 'search', 'help', '--help', '-h', 'bundle', 'status', 'train']);
 
 function showHelp() {
   console.log(
@@ -319,24 +319,41 @@ if (args[0] === 'validate') {
 
   const raw = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : null;
 
-  // Show indexing score breakdown
   if (raw) {
-    const { skillScore: _score } = await import('./parser.js').catch(() => ({}));
-    const willIndex = isSkillFile(file, raw);
+    const { filterWithClassifier, isSkillFile: _isSkill } = await import('./parser.js');
+    const { hardFilter } = await import('./src/filter/hard-filter.js');
+    const { loadModel } = await import('./src/filter/train.js');
+    const { embed } = await import('./embedder.js');
+    const { classify } = await import('./src/filter/classifier.js');
+
+    const hfResult = hardFilter(file, raw);
+    const willIndex = _isSkill(file, raw);
     const scoreLabel = willIndex ? chalk.green('✓ will be indexed') : chalk.red('✗ will be skipped by indexer');
     console.log(chalk.bold('\n  Indexing check: ') + scoreLabel);
 
-    // Show which signals were detected
-    const lines = raw.split('\n').filter(l => l.trim());
     const signals = [];
-    try { const { data } = (await import('gray-matter')).default(raw); if (data.name) signals.push(chalk.green('+4 frontmatter name:')); } catch {}
-    if (/^#{1,3}\s+(steps?|usage|instructions?|how\s+to|when\s+to\s+use|workflow)/im.test(raw)) signals.push(chalk.green('+2 instructional headers (## Steps / ## Usage)'));
-    if (lines.filter(l => /^#{1,3}\s/.test(l)).some(h => /\b(run|use|fix|debug|check|create|deploy|scan|audit)\b/i.test(h))) signals.push(chalk.green('+2 imperative verbs in headers'));
-    if (raw.includes('```')) signals.push(chalk.green('+1 code block'));
-    if (lines.some(l => /^\d+\.\s/.test(l))) signals.push(chalk.green('+1 numbered list'));
-    if (lines.some(l => /^[-*+]\s/.test(l))) signals.push(chalk.green('+1 bullet list'));
-    const firstH = lines.find(l => /^#{1,3}\s/.test(l))?.replace(/^#+\s*/, '') || '';
-    if (/^(overview|introduction|about|background|welcome)/i.test(firstH)) signals.push(chalk.red('-3 first header looks like docs ("' + firstH + '")'));
+    if (!hfResult.pass) {
+      signals.push(chalk.red(`✗ hard filter: ${hfResult.reason}`));
+    } else {
+      signals.push(chalk.green('✓ hard filter passed'));
+    }
+
+    const centroids = loadModel();
+    if (centroids) {
+      try {
+        const vec = await embed(raw);
+        const decision = classify(vec, centroids, raw, file);
+        const pct = (decision.score * 100).toFixed(0);
+        if (decision.label === 'skill') signals.push(chalk.green(`✓ classifier: skill (${pct}%)`));
+        else if (decision.label === 'unsure') signals.push(chalk.yellow(`? classifier: unsure (${pct}%)`));
+        else signals.push(chalk.red(`✗ classifier: reject (${pct}%)`));
+      } catch {
+        signals.push(chalk.gray('  classifier: embed failed (skip)'));
+      }
+    } else {
+      signals.push(chalk.gray('  classifier: no model (run `pg train`)'));
+    }
+
     if (signals.length) {
       signals.forEach(s => console.log('    ' + s));
     }
@@ -355,6 +372,22 @@ if (args[0] === 'validate') {
   }
 }
 
+if (args[0] === 'train') {
+  const { train: trainModel } = await import('./src/filter/train.js');
+  const spin = (await import('./cli.js')).spinner('Training classifier...');
+  spin.start();
+  try {
+    const model = await trainModel();
+    spin.stop();
+    success(`Classifier trained (${model.counts.good} good, ${model.counts.bad} bad examples)`);
+  } catch (e) {
+    spin.stop();
+    error(`Training failed: ${e.message}`);
+    process.exit(1);
+  }
+  process.exit(0);
+}
+
 if (args[0] === 'search') {
   const query = args.slice(1).join(' ');
   if (!query) { error('Usage: ' + bin + ' search <query>'); process.exit(1); }

package/indexer.js

@@ -2,8 +2,8 @@ import { globSync } from 'glob';
 import { createHash } from 'crypto';
 import fs from 'fs';
 import path from 'path';
-import { parseSkillFile, isSkillFile } from './parser.js';
-import { embedBatch, BATCH_SIZE } from './embedder.js';
+import { parseSkillFile, isSkillFile, filterWithClassifier } from './parser.js';
+import { embedBatch, cosineSimilarity, BATCH_SIZE } from './embedder.js';
 import { getDb, skillId, vecToBlob } from './db.js';
 import { loadConfig } from './config.js';
 import { chunkText } from './chunker.js';
@@ -11,16 +11,29 @@ import { buildAnnIndex } from './ann.js';
 import { progress, progressDone, success, info, spinner } from './cli.js';
 import chalk from 'chalk';
 
+const MAX_FILE_SIZE = 5 * 1024 * 1024;   // 5 MB per file
+const MAX_FILE_COUNT = 100000;            // 100k files per reindex
+
+function sanitizePath(filePath) {
+  return path.resolve(filePath);
+}
+
 async function indexBatch(db, skills, { fast = false } = {}) {
   const upsertSkill = db.prepare(`
-    INSERT INTO skills (id, name, description, path, source, content, hash)
-    VALUES (@id, @name, @description, @path, @source, @content, @hash)
+    INSERT INTO skills (id, name, description, path, source, content, hash, version, author, license, updated_at, downloads, verified)
+    VALUES (@id, @name, @description, @path, @source, @content, @hash, @version, @author, @license, @updated_at, @downloads, @verified)
     ON CONFLICT(id) DO UPDATE SET
       name = excluded.name,
       description = excluded.description,
       path = excluded.path,
       content = excluded.content,
-      hash = excluded.hash
+      hash = excluded.hash,
+      version = excluded.version,
+      author = excluded.author,
+      license = excluded.license,
+      updated_at = excluded.updated_at,
+      downloads = excluded.downloads,
+      verified = excluded.verified
   `);
   const deleteChunks = db.prepare('DELETE FROM chunks WHERE skill_id = ?');
   const deleteEdges = db.prepare('DELETE FROM edges WHERE from_skill = ?');
@@ -51,7 +64,7 @@ async function indexBatch(db, skills, { fast = false } = {}) {
   db.transaction(() => {
     for (const skill of skills) {
       const id = skillId(skill.source, skill.name);
-      upsertSkill.run({ id, name: skill.name, description: skill.description, path: skill.path, source: skill.source, content: skill.content, hash: skill.hash || null });
+      upsertSkill.run({ id, name: skill.name, description: skill.description, path: skill.path, source: skill.source, content: skill.content, hash: skill.hash || null, version: skill.version || null, author: skill.author || null, license: skill.license || null, updated_at: skill.updated_at || null, downloads: skill.downloads ?? 0, verified: skill.verified ? 1 : 0 });
       upsertFts.run(id, skill.name, skill.description || '', skill.content || '');
       if (!fast) {
         deleteChunks.run(id);
@@ -93,19 +106,30 @@ export async function indexAll({ fast = false } = {}) {
     normDir: path.resolve(s.dir),
   })).sort((a, b) => b.normDir.length - a.normDir.length); // longest first
 
+  console.error('DEBUG normalizedSources count:', normalizedSources.length);
+  console.error('DEBUG first dir:', normalizedSources[0]?.dir);
+
   const seenFiles = new Set();
   const allFiles = [];
   for (const { dir, source } of normalizedSources) {
     const files = globSync(`${dir}/**/*.md`);
+    console.error('DEBUG source:', source, 'dir:', dir, 'count:', files.length);
     for (const f of files) {
-      const norm = path.resolve(f);
+      const norm = sanitizePath(f);
       if (!seenFiles.has(norm)) {
         seenFiles.add(norm);
-        allFiles.push({ file: f, source });
+        allFiles.push({ file: norm, source });
+      } else {
+        console.error('DEBUG duplicate:', norm);
       }
     }
+    if (allFiles.length > MAX_FILE_COUNT) {
+      info(chalk.yellow(`Reached max file count (${MAX_FILE_COUNT}) — truncating`));
+      break;
+    }
   }
   const total = allFiles.length;
+  console.error('DEBUG total files found:', total);
   info(`Found ${chalk.white.bold(total)} files`);
 
   // reconcile: remove skills whose files no longer exist OR whose name changed
@@ -138,6 +162,7 @@ export async function indexAll({ fast = false } = {}) {
   let count = 0;
   let errors = 0;
   let skipped = 0;
+  let classifierRemoved = 0;
   let batch = [];
   const start = Date.now();
 
@@ -149,9 +174,13 @@ export async function indexAll({ fast = false } = {}) {
 
   for (const { file, source } of allFiles) {
     try {
-      // 1. Read file once
+      // 1. Read file once (with size gate)
       let raw;
-      try { raw = fs.readFileSync(file, 'utf8'); } catch { skipped++; count++; continue; }
+      try {
+        const stat = fs.statSync(file);
+        if (stat.size > MAX_FILE_SIZE) { skipped++; count++; continue; }
+        raw = fs.readFileSync(file, 'utf8');
+      } catch { skipped++; count++; continue; }
 
       // 2. Hash first — cheapest check
       const hash = createHash('md5').update(raw).digest('hex');
@@ -174,8 +203,10 @@ export async function indexAll({ fast = false } = {}) {
       batch.push({ ...parsed, hash });
 
       if (batch.length >= BATCH_SIZE) {
-        await indexBatch(db, batch, { fast });
-        count += batch.length;
+        const filtered = await filterWithClassifier(batch);
+        classifierRemoved += batch.length - filtered.length;
+        await indexBatch(db, filtered, { fast });
+        count += filtered.length;
         batch = [];
         const eta = count > 0 ? Math.round((total - count) * (Date.now() - start) / count / 1000) : '?';
         progress(count, total, { skipped, eta, errors });
@@ -196,8 +227,10 @@ export async function indexAll({ fast = false } = {}) {
   }
 
   if (batch.length > 0) {
-    await indexBatch(db, batch, { fast });
-    count += batch.length;
+    const filtered = await filterWithClassifier(batch);
+    classifierRemoved += batch.length - filtered.length;
+    await indexBatch(db, filtered, { fast });
+    count += filtered.length;
   }
 
   progress(total, total, { skipped, errors });
@@ -208,17 +241,22 @@ export async function indexAll({ fast = false } = {}) {
     await buildAnnIndex();
     spin.stop();
   }
-  success(`Indexed ${chalk.white.bold(count)} skills  ${chalk.gray(`(${errors} errors, ${skipped} skipped, ${removed} removed)`)}`);
+  const stats = [`${errors} errors`, `${skipped} skipped`, `${removed} removed`];
+  if (classifierRemoved > 0) stats.push(`${classifierRemoved} filtered`);
+  success(`Indexed ${chalk.white.bold(count)} skills  ${chalk.gray(`(${stats.join(', ')})`)}`);
   if (fast) info(chalk.yellow('Fast mode: keyword search only. Run `pg reindex` for semantic search.'));
   const elapsed = ((Date.now() - start) / 1000).toFixed(1);
   info(chalk.gray(`Time: ${elapsed}s`));
 }
 
 export async function indexFile(filePath, source) {
+  const safe = sanitizePath(filePath);
+  const stat = fs.statSync(safe);
+  if (stat.size > MAX_FILE_SIZE) throw new Error(`File too large: ${filePath}`);
   const db = getDb();
-  const raw = fs.readFileSync(filePath, 'utf8');
+  const raw = fs.readFileSync(safe, 'utf8');
   const hash = createHash('md5').update(raw).digest('hex');
-  const skill = parseSkillFile(filePath, source, { raw });
+  const skill = parseSkillFile(safe, source, { raw });
   await indexBatch(db, [{ ...skill, hash }]);
 }
 
@@ -249,7 +287,10 @@ export async function indexSource(dir, sourceName) {
 
   for (const file of files) {
     try {
-      const raw = fs.readFileSync(file, 'utf8');
+      const norm = sanitizePath(file);
+      const stat = fs.statSync(norm);
+      if (stat.size > MAX_FILE_SIZE) { skipped++; count++; continue; }
+      const raw = fs.readFileSync(norm, 'utf8');
       const hash = createHash('md5').update(raw).digest('hex');
       const dbRow = dbByPath.get(file);
       if (dbRow?.hash === hash) { skipped++; count++; continue; }

package/marketplace.js

@@ -42,6 +42,32 @@ const _require = createRequire(import.meta.url);
 const PKG_VERSION = (() => { try { return _require('./package.json').version; } catch { return '1.x'; } })();
 const UA = `promptgraph-mcp/${PKG_VERSION}`;
 
+const REGISTRY_ID_RE = /^[a-z0-9][a-z0-9-]{1,63}$/;
+
+function validateRegistryEntry(item) {
+  const errors = [];
+  if (!item.id || typeof item.id !== 'string') errors.push('missing required id');
+  else if (!REGISTRY_ID_RE.test(item.id)) errors.push(`invalid id "${item.id}" (must match /^[a-z0-9][a-z0-9-]{1,63}$/)`);
+  if (!item.name || typeof item.name !== 'string') errors.push('missing required name');
+  else if (item.name.length < 3) errors.push(`name "${item.name}" too short (min 3 chars)`);
+  if (!item.description || typeof item.description !== 'string') errors.push('missing required description');
+  else if (item.description.length < 15) errors.push(`description too short (min 15 chars)`);
+  if (item.version !== undefined && typeof item.version !== 'string') errors.push('version must be a string');
+  if (item.author !== undefined && typeof item.author !== 'string') errors.push('author must be a string');
+  if (item.license !== undefined && typeof item.license !== 'string') errors.push('license must be a string');
+  if (item.updated_at !== undefined) {
+    if (typeof item.updated_at !== 'string') errors.push('updated_at must be a string');
+    else if (isNaN(Date.parse(item.updated_at))) errors.push(`updated_at "${item.updated_at}" is not a valid ISO date`);
+  }
+  if (item.downloads !== undefined && typeof item.downloads !== 'number') errors.push('downloads must be a number');
+  if (item.verified !== undefined && typeof item.verified !== 'boolean') errors.push('verified must be a boolean');
+  if (errors.length > 0) {
+    console.warn(`[PromptGraph] Skipping invalid registry entry "${item.id || item.name || '(unnamed)'}": ${errors.join('; ')}`);
+    return { ok: false };
+  }
+  return { ok: true };
+}
+
 // Deterministic short code from an id. Same id always yields the same code,
 // so codes auto-generate — no need to assign them by hand.
 export function codeFor(id) {
@@ -137,6 +163,8 @@ export async function browseMarketplace(topK = 20) {
     if (!Array.isArray(registry.skills)) return { error: 'Invalid registry format' };
     return registry.skills
       .map(s => ({ ...s, code: s.code || codeFor(s.id) })) // auto-fill code
+      .filter(s => validateRegistryEntry(s).ok)
+      .filter(s => s.raw_url)
       .sort((a, b) => (b.stars || 0) - (a.stars || 0))
       .slice(0, topK);
   } catch (e) {
@@ -154,6 +182,10 @@ export async function installSkillFromUrl(url) {
     // derive filename from URL
     const urlName = rawUrl.split('/').pop().replace(/[^a-z0-9-_.]/gi, '-');
     const dest = path.join(SKILLS_DIR, urlName.endsWith('.md') ? urlName : urlName + '.md');
+    const resolvedDest = path.resolve(dest);
+    if (!resolvedDest.startsWith(path.resolve(SKILLS_DIR))) {
+      return { error: 'Path traversal blocked: destination outside marketplace directory' };
+    }
     const v = writeSkillAtomic(dest, content);
     if (!v.ok) return { error: 'Downloaded skill failed validation', issues: v.errors };
     return { success: true, path: dest, url: rawUrl };
@@ -172,8 +204,9 @@ export async function installSkill(query) {
     const text = await fetchText(REGISTRY_URL);
     const registry = JSON.parse(text);
     const q = String(query).trim().toLowerCase();
+    const validSkills = (registry.skills || []).filter(s => validateRegistryEntry(s).ok);
     // match by code (stored OR auto-generated), id, or name
-    const skill = registry.skills?.find(s =>
+    const skill = validSkills.find(s =>
       (s.code || codeFor(s.id)).toLowerCase() === q ||
       s.id?.toLowerCase() === q ||
       s.name?.toLowerCase() === q
@@ -191,6 +224,10 @@ export async function installSkill(query) {
     fs.mkdirSync(SKILLS_DIR, { recursive: true });
     ensureMarketplaceSource();
     const dest = path.join(SKILLS_DIR, `${skillId}.md`);
+    const resolvedDest = path.resolve(dest);
+    if (!resolvedDest.startsWith(path.resolve(SKILLS_DIR))) {
+      return { error: 'Path traversal blocked: destination outside marketplace directory' };
+    }
 
     const content = await fetchText(skill.raw_url);
     const v = writeSkillAtomic(dest, content);
@@ -222,7 +259,7 @@ export async function browseBundles(topK = 20) {
   try {
     const text = await fetchText(REGISTRY_URL);
     const registry = JSON.parse(text);
-    const bundles = registry.bundles || [];
+    const bundles = (registry.bundles || []).filter(b => validateRegistryEntry(b).ok);
     const cache = readSkillCountCache();
     const now = Date.now();
     let changed = false;
@@ -273,7 +310,8 @@ export async function installBundle(bundleId) {
     const text = await fetchText(REGISTRY_URL);
     const registry = JSON.parse(text);
     const q = String(bundleId).trim().toLowerCase();
-    const bundle = (registry.bundles || []).find(b =>
+    const validSkills = (registry.skills || []).filter(s => validateRegistryEntry(s).ok);
+    const bundle = (registry.bundles || []).filter(b => validateRegistryEntry(b).ok).find(b =>
       (b.code || codeFor(b.id)).toLowerCase() === q || b.id?.toLowerCase() === q || b.name?.toLowerCase() === q
     );
     if (!bundle) return { error: `No bundle matching "${bundleId}"` };
@@ -290,12 +328,16 @@ export async function installBundle(bundleId) {
 
     const delay = (ms) => new Promise(r => setTimeout(r, ms));
     for (const skillId of bundle.skills || []) {
-      const skill = registry.skills?.find(s => s.id === skillId);
+      const skill = validSkills.find(s => s.id === skillId);
       if (!skill?.raw_url) { failed.push(skillId); continue; }
       try {
         if (installed.length > 0) await delay(300); // rate limit: 300ms between requests
         const content = await fetchText(skill.raw_url);
         const dest = path.join(SKILLS_DIR, `${skillId}.md`);
+        const resolvedDest = path.resolve(dest);
+        if (!resolvedDest.startsWith(path.resolve(SKILLS_DIR))) {
+          failed.push(skillId); continue;
+        }
         const v = writeSkillAtomic(dest, content);
         if (!v.ok) { failed.push(skillId); continue; }
         installed.push(skillId);
@@ -478,7 +520,7 @@ export function pruneInvalidRepos() {
       continue;
     }
 
-    const mdFiles = globSync(`${src.dir}/**/*.md`);
+    const mdFiles = globSync(`${src.dir}/**/*.md`).map(fp => path.resolve(fp));
     if (mdFiles.length === 0) {
       removed.push({ repo: repoName, reason: 'no .md files' });
       config.sources = config.sources.filter(s => s !== src);

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "promptgraph-mcp",
-  "version": "2.4.6",
+  "version": "2.4.8",
+  "files": [
+    "*.js",
+    "src/**/*.js",
+    "README.md"
+  ],
   "main": "index.js",
   "type": "module",
   "bin": {
@@ -42,13 +47,14 @@
     "fastembed": "^2.1.0",
     "glob": "^13.0.6",
     "gray-matter": "^4.0.3",
+    "hnswlib-node": "^3.0.0",
     "ora": "^9.4.0"
   },
   "devDependencies": {
+    "@vitest/coverage-v8": "^4.1.8",
     "vitest": "^4.1.8"
   },
   "overrides": {
-    "tar": "^6.2.1",
-    "js-yaml": "^4.1.0"
+    "tar": "^6.2.1"
   }
 }

package/parser.js

@@ -1,136 +1,42 @@
 import fs from 'fs';
 import path from 'path';
 import matter from 'gray-matter';
+import { hardFilter } from './src/filter/hard-filter.js';
+import { classify } from './src/filter/classifier.js';
+import { loadModel } from './src/filter/train.js';
 
-// match /skill-name but not URLs (http://, https://, etc.)
 const SKILL_REF_RE = /(?<!https?:|ftp:)(?<![a-zA-Z0-9])\/([a-z0-9][a-z0-9-]{2,})/g;
 
-// Filenames that are never skills — docs, meta, legal files
-const SKIP_FILENAMES = new Set([
-  'readme', 'changelog', 'license', 'contributing', 'code-of-conduct',
-  'security', 'authors', 'credits', 'install', 'installation', 'usage',
-  'engagements', 'contributors', 'maintainers', 'acknowledgements',
-  'faq', 'glossary', 'index', 'overview', 'summary', 'roadmap', 'todo',
-  'notes', 'template', 'example', 'sample', 'demo', 'getting-started',
-  'quickstart', 'guide', 'tutorial', 'walkthrough', 'architecture',
-  'design', 'spec', 'specification', 'requirements', 'privacy', 'terms',
-  'disclaimer', 'notice', 'copying', 'warranty', 'codeofconduct',
-  'pull_request_template', 'issue_template', 'funding',
-]);
-
-// Filename patterns that are never skills — readme* catches ALL variants (readme_de, readme_zh-CN, etc.)
-const SKIP_FILENAME_RE = /^(_|\.)|^v?\d+[\.\-]\d+|^\d{4}[\-_]\d{2}|^readme|^license|^changelog|^contributing|^code.of.conduct|^security|^authors|^credits|^disclaimer|^notice|^copying|^warranty|^promotion|^funding/i;
-
-// Path segments that indicate the file is NOT a skill
-const SKIP_DIRS = new Set([
-  '.github', 'docs', 'doc', 'documentation', 'examples', 'example',
-  'tests', 'test', '__tests__', 'spec', 'fixtures', 'assets', 'images',
-  'img', 'screenshots', 'media', 'static', 'public', 'dist', 'build',
-  'node_modules', 'vendor', 'third_party',
-]);
-
-// First-header values that signal documentation, not a skill
-const DOC_FIRST_HEADERS = /^(overview|introduction|about|background|welcome|getting started|what is|why |table of contents|toc|foreword|preface|readme)/i;
-
-// Imperative verbs commonly found in skill headers
-const IMPERATIVE_HEADERS = /\b(run|use|apply|execute|check|debug|fix|create|add|remove|deploy|test|write|generate|analyze|review|refactor|optimize|configure|setup|install|scan|audit|validate|search|find|extract|parse)\b/i;
-
-// Instructional section headers
-const INSTRUCTION_HEADERS = /^#{1,3}\s+(steps?|usage|instructions?|how\s+to|when\s+to\s+use|workflow|process|procedure|example|examples?|commands?|output|result)/i;
-
-// ── scoring ───────────────────────────────────────────────────────────────────
-
-function skillScore(raw, base) {
-  let score = 0;
-
-  // Fast path: frontmatter with name = definitely a skill
-  try {
-    const { data } = matter(raw);
-    if (data.name && typeof data.name === 'string') return 10;
-  } catch {}
-
-  const lines = raw.split('\n');
-  const nonEmpty = lines.filter(l => l.trim());
-  const headers = nonEmpty.filter(l => /^#{1,3}\s/.test(l));
-
-  // Minimum viable content
-  if (raw.length < 150)  return -99;
-  if (headers.length < 1) return -99;
-
-  // ── positive signals ──────────────────────────────────────────────────────
-
-  // Instructional section names (## Steps, ## Usage, etc.)
-  if (lines.some(l => INSTRUCTION_HEADERS.test(l))) score += 2;
-
-  // Headers with imperative verbs
-  if (headers.some(h => IMPERATIVE_HEADERS.test(h))) score += 2;
-
-  // Code block
-  if (raw.includes('```') || raw.includes('    ')) score += 1;
-
-  // Numbered list (step-by-step)
-  if (nonEmpty.some(l => /^\d+\.\s/.test(l))) score += 1;
-
-  // Bullet list
-  if (nonEmpty.some(l => /^[-*+]\s/.test(l))) score += 1;
-
-  // Multiple headers (structure)
-  if (headers.length >= 2) score += 1;
-  if (headers.length >= 4) score += 1;
-
-  // ── negative signals ──────────────────────────────────────────────────────
-
-  // First header looks like documentation
-  const firstHeader = headers[0]?.replace(/^#+\s*/, '') || '';
-  if (DOC_FIRST_HEADERS.test(firstHeader)) score -= 3;
-
-  // Content is mostly long prose paragraphs (narrative, not instructional)
-  const paragraphs = raw.split(/\n\n+/).filter(p => p.trim() && !p.trim().startsWith('#'));
-  const longProse = paragraphs.filter(p => p.split(' ').length > 60 && !/```/.test(p));
-  if (longProse.length > paragraphs.length * 0.6 && paragraphs.length > 3) score -= 2;
-
-  // Filename looks like a version, date, or index
-  if (SKIP_FILENAME_RE.test(base)) score -= 3;
-
-  // Very high word repetition (filler content)
-  const words = raw.toLowerCase().split(/\s+/).filter(w => w.length > 3);
-  if (words.length > 80) {
-    const unique = new Set(words);
-    if (unique.size / words.length < 0.22) score -= 2;
-  }
-
-  return score;
-}
-
-// ── public API ────────────────────────────────────────────────────────────────
-
 export function isSkillFile(filePath, raw) {
-  const parts = filePath.replace(/\\/g, '/').split('/');
-  const base = parts[parts.length - 1].replace(/\.md$/i, '').toLowerCase();
-
-  // Hard-reject by filename
-  if (SKIP_FILENAMES.has(base)) return false;
-  if (SKIP_FILENAME_RE.test(base)) return false;
-
-  // Hard-reject by parent directory
-  for (const part of parts.slice(0, -1)) {
-    if (SKIP_DIRS.has(part.toLowerCase())) return false;
-  }
+  const result = hardFilter(filePath, raw);
+  if (!result.pass) return false;
 
   try {
     if (!raw) raw = fs.readFileSync(filePath, 'utf8');
-
-    // Hard-reject: content starts with README header or badge lines
     const firstLines = raw.trimStart().slice(0, 300);
     if (/^#\s*readme\b/i.test(firstLines)) return false;
     if (/!\[.*\]\(https?:\/\/(img\.shields\.io|badge\.fury|travis-ci|github\.com\/[^)]+\/badge)/i.test(firstLines)) return false;
 
-    return skillScore(raw, base) >= 3;
+    return true;
   } catch {
-    return false;
+    return true;
   }
 }
 
+export async function filterWithClassifier(skills) {
+  const centroids = loadModel();
+  if (!centroids) return skills;
+
+  const { embedBatch } = await import('./embedder.js');
+  const texts = skills.map(s => s.content || '');
+  const embeddings = await embedBatch(texts);
+
+  return skills.filter((_, i) => {
+    const decision = classify(embeddings[i], centroids, skills[i].content, skills[i].path);
+    return decision.label === 'skill' || decision.label === 'unsure';
+  });
+}
+
 export function parseSkillFile(filePath, source, opts = {}) {
   const raw = opts.raw ?? fs.readFileSync(filePath, 'utf8');