promptgraph-mcp 2.8.1 → 2.8.3

package/commands/status.js

@@ -1,110 +1,110 @@
-import { colors, banner, success, error, info, section, table } from '../cli.js';
-import chalk from 'chalk';
-import path from 'path';
-import os from 'os';
-import fs from 'fs';
-import boxen from 'boxen';
-
-export default async function handler(args, bin) {
-  const { loadConfig: _lc } = await import('../config.js');
-  const { getDb } = await import('../db.js');
-  const { fetchText } = await import('../marketplace.js');
-  const purple = chalk.hex('#7C3AED');
-  const cfg = _lc();
-  const db = getDb();
-
-  const sourceCounts = new Map();
-  for (const row of db.prepare('SELECT source, COUNT(*) as n FROM skills GROUP BY source').all()) {
-    sourceCounts.set(row.source, row.n);
-  }
-  const totalSkills = db.prepare('SELECT COUNT(*) as n FROM skills').get().n;
-  const totalBundles = cfg.sources.filter(s => s.source.startsWith('github:')).length;
-
-  let marketSkills = 0, marketBundles = 0;
-  try {
-    const REGISTRY_URL = 'https://raw.githubusercontent.com/NeiP4n/promptgraph-registry/main/registry.json';
-    const reg = JSON.parse(await fetchText(REGISTRY_URL));
-    marketSkills = reg.skills?.length || 0;
-    marketBundles = reg.bundles?.length || 0;
-  } catch {}
-
-  console.log();
-  console.log('  ' + purple.bold('◆ PromptGraph Status'));
-  console.log('  ' + chalk.gray('─'.repeat(56)));
-  console.log();
-
-  const skillsLine = chalk.bold.white(`${totalSkills} skills`) +
-    (marketSkills ? chalk.gray(` / ${marketSkills} in registry`) : '');
-  const bundlesLine = chalk.bold.white(`${totalBundles} repos`) +
-    (marketBundles ? chalk.gray(` / ${marketBundles} in marketplace`) : '');
-  console.log('  ' + skillsLine + chalk.gray('   ·   ') + bundlesLine);
-  console.log();
-
-  const githubSources = cfg.sources.filter(s => s.source.startsWith('github:'));
-  const localSources  = cfg.sources.filter(s => !s.source.startsWith('github:'));
-
-  if (localSources.length) {
-    console.log('  ' + purple('📁  Local'));
-    for (const s of localSources) {
-      const n = sourceCounts.get(s.source) || 0;
-      const exists = fs.existsSync(s.dir);
-      const label = exists ? chalk.white(s.source) : chalk.gray(s.source + ' (missing)');
-      console.log('    ' + label + chalk.gray(`  ${n} skills  ·  ${s.dir}`));
-    }
-    console.log();
-  }
-
-  if (githubSources.length) {
-    console.log('  ' + purple('🌐  GitHub repos'));
-    for (const s of githubSources) {
-      const n = sourceCounts.get(s.source) || 0;
-      const repoName = s.source.replace('github:', '');
-      const exists = fs.existsSync(s.dir);
-      const label = exists ? chalk.white(repoName) : chalk.gray(repoName + ' (not cloned)');
-      console.log('    ' + label + chalk.gray(`  ${n} skills`));
-      console.log('      ' + chalk.dim(s.dir));
-    }
-    console.log();
-  }
-
-  const marketplaceDir = path.join(os.homedir(), '.claude', 'skills-store', 'marketplace');
-  const installedBundles = fs.existsSync(marketplaceDir)
-    ? fs.readdirSync(marketplaceDir, { withFileTypes: true }).filter(d => d.isDirectory()).map(d => d.name)
-    : [];
-
-  if (installedBundles.length) {
-    let registryBundles = [];
-    try {
-      const REGISTRY_URL = 'https://raw.githubusercontent.com/NeiP4n/promptgraph-registry/main/registry.json';
-      const text = await fetchText(REGISTRY_URL);
-      registryBundles = JSON.parse(text).bundles || [];
-    } catch {}
-
-    console.log('  ' + purple('📦  Installed marketplace bundles'));
-    for (const b of installedBundles) {
-      const bundle = registryBundles.find(rb => rb.id === b);
-      const name = bundle ? chalk.white.bold(bundle.name || b) : chalk.white(b);
-      const cat  = bundle?.category ? chalk.dim(` [${bundle.category}]`) : '';
-      const n    = sourceCounts.get('marketplace') || 0;
-      console.log(`    ${name}${cat}  ${chalk.gray(n + ' skills')}`);
-    }
-    console.log();
-  }
-
-  const emptyRepos = githubSources.filter(s => (sourceCounts.get(s.source) || 0) === 0 && fs.existsSync(s.dir));
-  if (emptyRepos.length) {
-    console.log('  ' + chalk.yellow(`⚠  ${emptyRepos.length} repo(s) not indexed`) + chalk.gray('  →  run: ') + chalk.cyan(`${bin} reindex`));
-    console.log();
-  }
-
-  console.log(
-    boxen(
-      chalk.dim('full reindex   ') + chalk.cyan(`${bin} reindex`) + '\n' +
-      chalk.dim('install bundle ') + chalk.cyan(`${bin} bundle install <id>`) + '\n' +
-      chalk.dim('browse market  ') + chalk.cyan(`${bin} marketplace bundles`),
-      { padding: { top: 0, bottom: 0, left: 1, right: 1 }, borderStyle: 'round', borderColor: '#4B5563', dimBorder: true }
-    )
-  );
-  console.log();
-  process.exit(0);
-}
+import { colors, banner, success, error, info, section, table } from '../cli.js';
+import chalk from 'chalk';
+import path from 'path';
+import os from 'os';
+import fs from 'fs';
+import boxen from 'boxen';
+
+export default async function handler(args, bin) {
+  const { loadConfig: _lc } = await import('../config.js');
+  const { getDb } = await import('../db.js');
+  const { fetchText } = await import('../marketplace.js');
+  const purple = chalk.hex('#7C3AED');
+  const cfg = _lc();
+  const db = getDb();
+
+  const sourceCounts = new Map();
+  for (const row of db.prepare('SELECT source, COUNT(*) as n FROM skills GROUP BY source').all()) {
+    sourceCounts.set(row.source, row.n);
+  }
+  const totalSkills = db.prepare('SELECT COUNT(*) as n FROM skills').get().n;
+  const totalBundles = cfg.sources.filter(s => s.source.startsWith('github:')).length;
+
+  let marketSkills = 0, marketBundles = 0;
+  try {
+    const REGISTRY_URL = 'https://raw.githubusercontent.com/NeiP4n/promptgraph-registry/main/registry.json';
+    const reg = JSON.parse(await fetchText(REGISTRY_URL));
+    marketSkills = reg.skills?.length || 0;
+    marketBundles = reg.bundles?.length || 0;
+  } catch {}
+
+  console.log();
+  console.log('  ' + purple.bold('◆ PromptGraph Status'));
+  console.log('  ' + chalk.gray('─'.repeat(56)));
+  console.log();
+
+  const skillsLine = chalk.bold.white(`${totalSkills} skills`) +
+    (marketSkills ? chalk.gray(` / ${marketSkills} in registry`) : '');
+  const bundlesLine = chalk.bold.white(`${totalBundles} repos`) +
+    (marketBundles ? chalk.gray(` / ${marketBundles} in marketplace`) : '');
+  console.log('  ' + skillsLine + chalk.gray('   ·   ') + bundlesLine);
+  console.log();
+
+  const githubSources = cfg.sources.filter(s => s.source.startsWith('github:'));
+  const localSources  = cfg.sources.filter(s => !s.source.startsWith('github:'));
+
+  if (localSources.length) {
+    console.log('  ' + purple('📁  Local'));
+    for (const s of localSources) {
+      const n = sourceCounts.get(s.source) || 0;
+      const exists = fs.existsSync(s.dir);
+      const label = exists ? chalk.white(s.source) : chalk.gray(s.source + ' (missing)');
+      console.log('    ' + label + chalk.gray(`  ${n} skills  ·  ${s.dir}`));
+    }
+    console.log();
+  }
+
+  if (githubSources.length) {
+    console.log('  ' + purple('🌐  GitHub repos'));
+    for (const s of githubSources) {
+      const n = sourceCounts.get(s.source) || 0;
+      const repoName = s.source.replace('github:', '');
+      const exists = fs.existsSync(s.dir);
+      const label = exists ? chalk.white(repoName) : chalk.gray(repoName + ' (not cloned)');
+      console.log('    ' + label + chalk.gray(`  ${n} skills`));
+      console.log('      ' + chalk.dim(s.dir));
+    }
+    console.log();
+  }
+
+  const marketplaceDir = path.join(os.homedir(), '.claude', 'skills-store', 'marketplace');
+  const installedBundles = fs.existsSync(marketplaceDir)
+    ? fs.readdirSync(marketplaceDir, { withFileTypes: true }).filter(d => d.isDirectory()).map(d => d.name)
+    : [];
+
+  if (installedBundles.length) {
+    let registryBundles = [];
+    try {
+      const REGISTRY_URL = 'https://raw.githubusercontent.com/NeiP4n/promptgraph-registry/main/registry.json';
+      const text = await fetchText(REGISTRY_URL);
+      registryBundles = JSON.parse(text).bundles || [];
+    } catch {}
+
+    console.log('  ' + purple('📦  Installed marketplace bundles'));
+    for (const b of installedBundles) {
+      const bundle = registryBundles.find(rb => rb.id === b);
+      const name = bundle ? chalk.white.bold(bundle.name || b) : chalk.white(b);
+      const cat  = bundle?.category ? chalk.dim(` [${bundle.category}]`) : '';
+      const n    = sourceCounts.get('marketplace') || 0;
+      console.log(`    ${name}${cat}  ${chalk.gray(n + ' skills')}`);
+    }
+    console.log();
+  }
+
+  const emptyRepos = githubSources.filter(s => (sourceCounts.get(s.source) || 0) === 0 && fs.existsSync(s.dir));
+  if (emptyRepos.length) {
+    console.log('  ' + chalk.yellow(`⚠  ${emptyRepos.length} repo(s) not indexed`) + chalk.gray('  →  run: ') + chalk.cyan(`${bin} reindex`));
+    console.log();
+  }
+
+  console.log(
+    boxen(
+      chalk.dim('full reindex   ') + chalk.cyan(`${bin} reindex`) + '\n' +
+      chalk.dim('install bundle ') + chalk.cyan(`${bin} bundle install <id>`) + '\n' +
+      chalk.dim('browse market  ') + chalk.cyan(`${bin} marketplace bundles`),
+      { padding: { top: 0, bottom: 0, left: 1, right: 1 }, borderStyle: 'round', borderColor: '#4B5563', dimBorder: true }
+    )
+  );
+  console.log();
+  process.exit(0);
+}

package/commands/train.js

@@ -1,18 +1,18 @@
-import { colors, banner, success, error, info, section, table } from '../cli.js';
-import chalk from 'chalk';
-
-export default async function handler(args, bin) {
-  const { train: trainModel } = await import('../src/filter/train.js');
-  const spin = (await import('../cli.js')).spinner('Training classifier...');
-  spin.start();
-  try {
-    const model = await trainModel();
-    spin.stop();
-    success(`Classifier trained (${model.counts.good} good, ${model.counts.bad} bad examples)`);
-  } catch (e) {
-    spin.stop();
-    error(`Training failed: ${e.message}`);
-    process.exit(1);
-  }
-  process.exit(0);
-}
+import { colors, banner, success, error, info, section, table } from '../cli.js';
+import chalk from 'chalk';
+
+export default async function handler(args, bin) {
+  const { train: trainModel } = await import('../src/filter/train.js');
+  const spin = (await import('../cli.js')).spinner('Training classifier...');
+  spin.start();
+  try {
+    const model = await trainModel();
+    spin.stop();
+    success(`Classifier trained (${model.counts.good} good, ${model.counts.bad} bad examples)`);
+  } catch (e) {
+    spin.stop();
+    error(`Training failed: ${e.message}`);
+    process.exit(1);
+  }
+  process.exit(0);
+}

package/commands/update.js

@@ -1,49 +1,49 @@
-import { colors, banner, success, error, info, section, table } from '../cli.js';
-import chalk from 'chalk';
-
-export default async function handler(args, bin) {
-  const { spawnSync } = await import('child_process');
-  const { createRequire } = await import('module');
-  const https = (await import('https')).default;
-  const req = createRequire(import.meta.url);
-  const currentVersion = req('../package.json').version;
-
-  const spin = (await import('../cli.js')).spinner('Checking latest version...');
-  spin.start();
-  let latest = null;
-  try {
-    latest = await new Promise((res, rej) => {
-      const r = https.get('https://registry.npmjs.org/promptgraph-mcp/latest',
-        { headers: { Accept: 'application/json' }, timeout: 8000, family: 4 },
-        (resp) => {
-          let d = ''; resp.setEncoding('utf8');
-          resp.on('data', c => d += c);
-          resp.on('end', () => { try { res(JSON.parse(d).version); } catch { rej(new Error('bad response')); } });
-        }
-      );
-      r.on('error', rej);
-      r.on('timeout', () => { r.destroy(new Error('timeout')); });
-    });
-  } catch {}
-  spin.stop();
-
-  if (!latest) { error('Could not reach npm registry. Check your network.'); process.exit(1); }
-  if (latest === currentVersion) {
-    success(`Already on latest version ${chalk.white.bold('v' + currentVersion)}`);
-    process.exit(0);
-  }
-
-  info(`Current: ${chalk.gray('v' + currentVersion)}  →  Latest: ${chalk.white.bold('v' + latest)}`);
-  const updateSpin = (await import('../cli.js')).spinner(`Installing promptgraph-mcp@latest (v${latest})...`);
-  updateSpin.start();
-  const result = spawnSync('npm', ['install', '-g', 'promptgraph-mcp@latest'], { encoding: 'utf8', stdio: 'pipe', shell: true });
-  updateSpin.stop();
-
-  if (result.status !== 0) {
-    error('Update failed:');
-    console.log(chalk.gray(result.stderr || result.stdout));
-    process.exit(1);
-  }
-  success(`Updated to ${chalk.white.bold('v' + latest)}`);
-  process.exit(0);
-}
+import { colors, banner, success, error, info, section, table } from '../cli.js';
+import chalk from 'chalk';
+
+export default async function handler(args, bin) {
+  const { spawnSync } = await import('child_process');
+  const { createRequire } = await import('module');
+  const https = (await import('https')).default;
+  const req = createRequire(import.meta.url);
+  const currentVersion = req('../package.json').version;
+
+  const spin = (await import('../cli.js')).spinner('Checking latest version...');
+  spin.start();
+  let latest = null;
+  try {
+    latest = await new Promise((res, rej) => {
+      const r = https.get('https://registry.npmjs.org/promptgraph-mcp/latest',
+        { headers: { Accept: 'application/json' }, timeout: 8000, family: 4 },
+        (resp) => {
+          let d = ''; resp.setEncoding('utf8');
+          resp.on('data', c => d += c);
+          resp.on('end', () => { try { res(JSON.parse(d).version); } catch { rej(new Error('bad response')); } });
+        }
+      );
+      r.on('error', rej);
+      r.on('timeout', () => { r.destroy(new Error('timeout')); });
+    });
+  } catch {}
+  spin.stop();
+
+  if (!latest) { error('Could not reach npm registry. Check your network.'); process.exit(1); }
+  if (latest === currentVersion) {
+    success(`Already on latest version ${chalk.white.bold('v' + currentVersion)}`);
+    process.exit(0);
+  }
+
+  info(`Current: ${chalk.gray('v' + currentVersion)}  →  Latest: ${chalk.white.bold('v' + latest)}`);
+  const updateSpin = (await import('../cli.js')).spinner(`Installing promptgraph-mcp@latest (v${latest})...`);
+  updateSpin.start();
+  const result = spawnSync('npm', ['install', '-g', 'promptgraph-mcp@latest'], { encoding: 'utf8', stdio: 'pipe', shell: true });
+  updateSpin.stop();
+
+  if (result.status !== 0) {
+    error('Update failed:');
+    console.log(chalk.gray(result.stderr || result.stdout));
+    process.exit(1);
+  }
+  success(`Updated to ${chalk.white.bold('v' + latest)}`);
+  process.exit(0);
+}

package/commands/validate.js

@@ -1,63 +1,63 @@
-import { colors, banner, success, error, info, section, table } from '../cli.js';
-import chalk from 'chalk';
-import fs from 'fs';
-
-export default async function handler(args, bin) {
-  const { validateSkill } = await import('../validator.js');
-  const file = args[1];
-  if (!file) { error('Usage: ' + bin + ' validate <skill.md>'); process.exit(1); }
-
-  const raw = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : null;
-
-  if (raw) {
-    const { filterWithClassifier, isSkillFile: _isSkill } = await import('../parser.js');
-    const { hardFilter } = await import('../src/filter/hard-filter.js');
-    const { loadModel } = await import('../src/filter/train.js');
-    const { embed } = await import('../embedder.js');
-    const { classify } = await import('../src/filter/classifier.js');
-
-    const hfResult = hardFilter(file, raw);
-    const willIndex = _isSkill(file, raw);
-    const scoreLabel = willIndex ? chalk.green('✓ will be indexed') : chalk.red('✗ will be skipped by indexer');
-    console.log(chalk.bold('\n  Indexing check: ') + scoreLabel);
-
-    const signals = [];
-    if (!hfResult.pass) {
-      signals.push(chalk.red(`✗ hard filter: ${hfResult.reason}`));
-    } else {
-      signals.push(chalk.green('✓ hard filter passed'));
-    }
-
-    const centroids = loadModel();
-    if (centroids) {
-      try {
-        const vec = await embed(raw);
-        const decision = classify(vec, centroids, raw, file);
-        const pct = (decision.score * 100).toFixed(0);
-        if (decision.label === 'skill') signals.push(chalk.green(`✓ classifier: skill (${pct}%)`));
-        else if (decision.label === 'unsure') signals.push(chalk.yellow(`? classifier: unsure (${pct}%)`));
-        else signals.push(chalk.red(`✗ classifier: reject (${pct}%)`));
-      } catch {
-        signals.push(chalk.gray('  classifier: embed failed (skip)'));
-      }
-    } else {
-      signals.push(chalk.gray('  classifier: no model (run `pg train`)'));
-    }
-
-    if (signals.length) {
-      signals.forEach(s => console.log('    ' + s));
-    }
-    console.log();
-  }
-
-  const result = validateSkill(file);
-  result.warnings.forEach(w => console.log(chalk.yellow('⚠') + '  ' + chalk.gray(w)));
-  if (result.ok) {
-    success('Skill is valid — ready to publish');
-    process.exit(0);
-  } else {
-    error('Validation failed:');
-    result.errors.forEach(e => console.log('   ' + chalk.red('•') + ' ' + e));
-    process.exit(1);
-  }
-}
+import { colors, banner, success, error, info, section, table } from '../cli.js';
+import chalk from 'chalk';
+import fs from 'fs';
+
+export default async function handler(args, bin) {
+  const { validateSkill } = await import('../validator.js');
+  const file = args[1];
+  if (!file) { error('Usage: ' + bin + ' validate <skill.md>'); process.exit(1); }
+
+  const raw = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : null;
+
+  if (raw) {
+    const { filterWithClassifier, isSkillFile: _isSkill } = await import('../parser.js');
+    const { hardFilter } = await import('../src/filter/hard-filter.js');
+    const { loadModel } = await import('../src/filter/train.js');
+    const { embed } = await import('../embedder.js');
+    const { classify } = await import('../src/filter/classifier.js');
+
+    const hfResult = hardFilter(file, raw);
+    const willIndex = _isSkill(file, raw);
+    const scoreLabel = willIndex ? chalk.green('✓ will be indexed') : chalk.red('✗ will be skipped by indexer');
+    console.log(chalk.bold('\n  Indexing check: ') + scoreLabel);
+
+    const signals = [];
+    if (!hfResult.pass) {
+      signals.push(chalk.red(`✗ hard filter: ${hfResult.reason}`));
+    } else {
+      signals.push(chalk.green('✓ hard filter passed'));
+    }
+
+    const centroids = loadModel();
+    if (centroids) {
+      try {
+        const vec = await embed(raw);
+        const decision = classify(vec, centroids, raw, file);
+        const pct = (decision.score * 100).toFixed(0);
+        if (decision.label === 'skill') signals.push(chalk.green(`✓ classifier: skill (${pct}%)`));
+        else if (decision.label === 'unsure') signals.push(chalk.yellow(`? classifier: unsure (${pct}%)`));
+        else signals.push(chalk.red(`✗ classifier: reject (${pct}%)`));
+      } catch {
+        signals.push(chalk.gray('  classifier: embed failed (skip)'));
+      }
+    } else {
+      signals.push(chalk.gray('  classifier: no model (run `pg train`)'));
+    }
+
+    if (signals.length) {
+      signals.forEach(s => console.log('    ' + s));
+    }
+    console.log();
+  }
+
+  const result = validateSkill(file);
+  result.warnings.forEach(w => console.log(chalk.yellow('⚠') + '  ' + chalk.gray(w)));
+  if (result.ok) {
+    success('Skill is valid — ready to publish');
+    process.exit(0);
+  } else {
+    error('Validation failed:');
+    result.errors.forEach(e => console.log('   ' + chalk.red('•') + ' ' + e));
+    process.exit(1);
+  }
+}

package/config.js

@@ -1,72 +1,72 @@
-import fs from 'fs';
-import path from 'path';
-import os from 'os';
-import readline from 'readline';
-
-const CLAUDE_DIR = path.join(os.homedir(), '.claude');
-export const PROMPTGRAPH_DIR = path.join(CLAUDE_DIR, '.promptgraph');
-export const SKILLS_STORE_DIR = path.join(CLAUDE_DIR, 'skills-store');
-const CONFIG_PATH = path.join(PROMPTGRAPH_DIR, 'config.json');
-
-export const MAX_DOWNLOAD_SIZE = 50 * 1024 * 1024  // 50 MB per file
-export const MAX_FILE_COUNT = 50000                  // max files per repo
-export const MAX_REPO_SIZE = 500 * 1024 * 1024      // 500 MB per repo
-export const RATE_LIMIT_REQUESTS = 30               // requests per window
-export const RATE_LIMIT_WINDOW_MS = 60000           // 1 minute window
-export const BATCH_SIZE = 100                       // batch indexing size
-
-const DEFAULTS = {
-  sources: [
-    { dir: path.join(CLAUDE_DIR, 'skills-store'), source: 'skills-store' },
-    { dir: path.join(CLAUDE_DIR, 'skills'),    source: 'skills' },
-    { dir: path.join(CLAUDE_DIR, 'commands'),  source: 'commands' },
-  ],
-};
-
-
-export function loadConfig() {
-  if (fs.existsSync(CONFIG_PATH)) {
-    return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8'));
-  }
-  return JSON.parse(JSON.stringify(DEFAULTS));
-}
-
-export function saveConfig(config) {
-  fs.mkdirSync(path.dirname(CONFIG_PATH), { recursive: true });
-  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
-}
-
-export async function promptConfig() {
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  const ask = (q) => new Promise(r => rl.question(q, r));
-
-  console.log('\n=== PromptGraph Setup ===\n');
-  console.log('Default skill directories:');
-  DEFAULTS.sources.forEach((s, i) => console.log(`  ${i + 1}. ${s.dir}`));
-
-  const extra = await ask('\nAdd extra skill directories? (comma-separated paths, or press Enter to skip): ');
-  rl.close();
-
-  const config = structuredClone(DEFAULTS);
-
-  if (extra.trim()) {
-    const extraDirs = extra.split(',').map(d => d.trim()).filter(Boolean);
-    for (const dir of extraDirs) {
-      const base = path.basename(path.resolve(dir));
-      const existing = config.sources.filter(s => s.source === `custom:${base}`);
-      const tag = existing.length === 0 ? `custom:${base}` : `custom:${base}-${existing.length}`;
-      config.sources.push({ dir, source: tag });
-    }
-  }
-
-  saveConfig(config);
-  console.log(`\nConfig saved to ${CONFIG_PATH}`);
-  return config;
-}
-
-export function sanitizePath(inputPath) {
-  if (inputPath.includes('..')) {
-    throw new Error(`Path traversal blocked: "${inputPath}"`);
-  }
-  return path.resolve(inputPath);
-}
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import readline from 'readline';
+
+const CLAUDE_DIR = path.join(os.homedir(), '.claude');
+export const PROMPTGRAPH_DIR = path.join(CLAUDE_DIR, '.promptgraph');
+export const SKILLS_STORE_DIR = path.join(CLAUDE_DIR, 'skills-store');
+const CONFIG_PATH = path.join(PROMPTGRAPH_DIR, 'config.json');
+
+export const MAX_DOWNLOAD_SIZE = 50 * 1024 * 1024  // 50 MB per file
+export const MAX_FILE_COUNT = 50000                  // max files per repo
+export const MAX_REPO_SIZE = 500 * 1024 * 1024      // 500 MB per repo
+export const RATE_LIMIT_REQUESTS = 30               // requests per window
+export const RATE_LIMIT_WINDOW_MS = 60000           // 1 minute window
+export const BATCH_SIZE = 100                       // batch indexing size
+
+const DEFAULTS = {
+  sources: [
+    { dir: path.join(CLAUDE_DIR, 'skills-store'), source: 'skills-store' },
+    { dir: path.join(CLAUDE_DIR, 'skills'),    source: 'skills' },
+    { dir: path.join(CLAUDE_DIR, 'commands'),  source: 'commands' },
+  ],
+};
+
+
+export function loadConfig() {
+  if (fs.existsSync(CONFIG_PATH)) {
+    return JSON.parse(fs.readFileSync(CONFIG_PATH, 'utf8'));
+  }
+  return JSON.parse(JSON.stringify(DEFAULTS));
+}
+
+export function saveConfig(config) {
+  fs.mkdirSync(path.dirname(CONFIG_PATH), { recursive: true });
+  fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2));
+}
+
+export async function promptConfig() {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const ask = (q) => new Promise(r => rl.question(q, r));
+
+  console.log('\n=== PromptGraph Setup ===\n');
+  console.log('Default skill directories:');
+  DEFAULTS.sources.forEach((s, i) => console.log(`  ${i + 1}. ${s.dir}`));
+
+  const extra = await ask('\nAdd extra skill directories? (comma-separated paths, or press Enter to skip): ');
+  rl.close();
+
+  const config = structuredClone(DEFAULTS);
+
+  if (extra.trim()) {
+    const extraDirs = extra.split(',').map(d => d.trim()).filter(Boolean);
+    for (const dir of extraDirs) {
+      const base = path.basename(path.resolve(dir));
+      const existing = config.sources.filter(s => s.source === `custom:${base}`);
+      const tag = existing.length === 0 ? `custom:${base}` : `custom:${base}-${existing.length}`;
+      config.sources.push({ dir, source: tag });
+    }
+  }
+
+  saveConfig(config);
+  console.log(`\nConfig saved to ${CONFIG_PATH}`);
+  return config;
+}
+
+export function sanitizePath(inputPath) {
+  if (inputPath.includes('..')) {
+    throw new Error(`Path traversal blocked: "${inputPath}"`);
+  }
+  return path.resolve(inputPath);
+}