promptgraph-mcp 2.9.43 → 2.9.46

package/.claude-plugin/plugin.json

@@ -1,8 +1,8 @@
-{
-  "name": "promptgraph",
-  "description": "Semantic skill router for Claude Code — search and load only the skills you need, saving 20k+ tokens per session. Includes a marketplace with 40+ community skill bundles.",
-  "author": {
-    "name": "NeiP4n"
-  },
-  "homepage": "https://github.com/NeiP4n/promptgraph"
-}
+{
+  "name": "promptgraph",
+  "description": "Semantic skill router for Claude Code — search and load only the skills you need, saving 20k+ tokens per session. Includes a marketplace with 40+ community skill bundles.",
+  "author": {
+    "name": "NeiP4n"
+  },
+  "homepage": "https://github.com/NeiP4n/promptgraph"
+}

package/.mcp.json

@@ -1,6 +1,6 @@
-{
-  "promptgraph": {
-    "command": "npx",
-    "args": ["-y", "promptgraph-mcp"]
-  }
-}
+{
+  "promptgraph": {
+    "command": "npx",
+    "args": ["-y", "promptgraph-mcp"]
+  }
+}

package/README.md

@@ -9,6 +9,18 @@ Instead of loading every `.md` skill into context, Claude calls `pg_search` and
 
 ---
 
+## Features
+
+- **Semantic search** — BGE-Small-EN embeddings, local, no API key required
+- **Token savings** — loads one skill on demand instead of all `.md` files (~20k+ tokens/session)
+- **Fast reindex** — persistent embed cache makes re-indexing unchanged skills near-instant
+- **Low RAM** — first index uses ~0.85 GB (vs 5+ GB in older versions)
+- **Marketplace** — browse and install community skill bundles via TUI or MCP tools
+- **Publishing** — publish skills/bundles to the registry hands-off via GitHub CLI
+- **Multi-platform** — Claude Code, OpenCode, Claude Desktop, Cursor, Windsurf, Cline, Codex
+
+---
+
 ## Install
 
 ```bash
@@ -50,16 +62,26 @@ Then restart your editor — the `promptgraph` MCP server will be available.
 ## CLI commands
 
 ```bash
-pg setup <platform>     # Setup MCP config + skills dir for a platform
-pg search <query>       # Semantic search across your skills
-pg list                 # List all indexed skills
-pg add <file>           # Add a skill file and index it
-pg reindex              # Re-index all skills (with progress bar + ETA)
-pg marketplace          # Browse community skill bundles (TUI)
-pg install <id>         # Install a skill or bundle by ID
-pg doctor               # Check database integrity
-pg doctor --reset-dead  # Restore bundles hidden after install errors
-pg update               # Update promptgraph-mcp to latest version
+# Setup & maintenance
+pg setup <platform>             # Setup MCP config + skills dir for a platform
+pg reindex                      # Re-index all skills (progress bar + ETA)
+pg status                       # Show index health: sources, skill counts, DB path
+pg doctor                       # Check database integrity
+pg doctor --reset-dead          # Restore bundles hidden after install errors
+pg update                       # Update promptgraph-mcp to latest version
+
+# Search & discovery
+pg search <query>               # Semantic search across your skills
+pg marketplace                  # Browse community skill bundles (TUI)
+
+# Install
+pg install <id>                 # Install a skill by marketplace ID (pg-xxxxxx)
+pg import <github-url>          # Import skills directly from a GitHub repo URL
+
+# Bundles
+pg bundle install <id>          # Install a bundle by ID
+pg bundle update [repo]         # Pull latest from installed GitHub bundles
+pg bundle add-repo <owner/repo> # Publish your GitHub repo to the registry (requires gh)
 ```
 
 ---
@@ -80,14 +102,36 @@ These are MCP prompts, not tools — they appear in the `/` command palette.
 Browse and install community skill bundles:
 
 ```bash
-pg marketplace          # Interactive TUI browser
-pg install pg-xxxxxx    # Install by bundle ID
+pg marketplace              # Interactive TUI browser
+pg install pg-xxxxxx        # Install by bundle ID
+pg bundle install pg-xxxxxx # Same, explicit subcommand form
 ```
 
 Bundles marked with 🔧 include tool scripts (`.py`, `.sh`, `.js`) alongside `.md` skill files. Scripts are installed to the platform's skills directory and made executable automatically.
 
 ---
 
+## Publishing
+
+Publishing to the registry requires the [GitHub CLI](https://cli.github.com) signed in:
+
+```bash
+gh auth login               # one-time setup
+```
+
+**Publish your own skill:**
+Use the `pg_marketplace_publish` MCP tool from inside Claude. It creates a Gist and automatically files a registry issue — no browser step, no paste.
+
+**Publish a GitHub repo as a bundle:**
+```bash
+pg bundle add-repo <owner/repo>       # auto-submits registry issue
+pg bundle add-repo <owner/repo> --push # same, with git push to the repo first
+```
+
+The registry bot reads the submitted JSON and publishes within minutes.
+
+---
+
 ## Skill bundles with tools
 
 A bundle can ship both skill files (`.md`) and tool scripts (`.py`, `.sh`, `.js`, etc.). When installed:
@@ -106,6 +150,8 @@ Bundle authors: set `has_tools: true` and include `tool_files` entries in your b
 3. When Claude calls `pg_search("refactor without breaking tests")`, only the matching skill is loaded into context
 4. Skills are scored — `pg_top_rated` returns the best-performing ones
 
+**Memory usage**: The first index uses ~0.85 GB RAM (batch=16 default). Override with `PG_EMBED_BATCH` if needed. Subsequent reindexes of unchanged content are near-instant thanks to a persistent embed cache.
+
 ---
 
 ## Troubleshooting
@@ -124,9 +170,19 @@ Close any terminals running `pg` commands, then run `pg update` again.
 **OpenCode not seeing MCP:**
 Run `pg setup opencode` — it writes the correct `{ "type": "local", "command": ["cmd", "/c", "npx", "promptgraph-mcp"] }` entry to `~/.config/opencode/opencode.json`.
 
+**Publishing fails with "gh auth":**
+Install the [GitHub CLI](https://cli.github.com) and run `gh auth login`.
+
 ---
 
 ## Requirements
 
 - Node.js ≥ 18
 - ~45 MB disk for the embedding model (downloaded on first use)
+- [GitHub CLI](https://cli.github.com) — only needed for publishing to the marketplace
+
+---
+
+## License
+
+MIT

package/commands/bundle.js

@@ -98,11 +98,11 @@ export default async function handler(args, bin) {
     const { detectSkillsDirFromAPI: _detectDir } = await import('../github-import.js');
     process.stdout.write(chalk.gray(`  Checking ${repo} for skill subdirectory... `));
     const detected = await _detectDir(repo);
-    if (!detected) {
-      console.log(chalk.red('none found'));
+    if (detected === null) {
+      console.log(chalk.red('not found'));
       error(
-        `Cannot publish: no skill subdirectory found in ${repo}\n` +
-        `  Expected: skills/, prompts/, commands/, agents/, or any folder with .md files\n` +
+        `Cannot publish: no .md skill files found in ${repo}\n` +
+        `  Make sure the repo has .md skill files at root or in a skills/ subdirectory.\n` +
         `  Visit: https://github.com/${repo}`
       );
       process.exit(1);
@@ -118,6 +118,10 @@ export default async function handler(args, bin) {
     };
     const json = JSON.stringify(bundle, null, 2);
 
+    const { requireGhAuth } = await import('../marketplace.js');
+    const auth = requireGhAuth();
+    if (!auth.ok) { error(auth.error); process.exit(1); }
+
     if (doPush) {
       const registryDir = path.join(os.tmpdir(), 'pg-push-registry');
       const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: '0' };
@@ -147,40 +151,7 @@ export default async function handler(args, bin) {
       const result = await publishBundle(tmp);
       fs.unlinkSync(tmp);
       if (result?.error) { error(result.error); process.exit(1); }
-      if (result.gh_not_installed) {
-        const bodyText = 'Bundle definition:\n\n```json\n' + json + '\n```';
-
-        // Copy body to clipboard
-        let copied = false;
-        try {
-          if (process.platform === 'win32') {
-            const r = spawnSync('powershell', ['-NoProfile', '-Command', `Set-Clipboard -Value ${JSON.stringify(bodyText)}`], { stdio: 'pipe' });
-            copied = r.status === 0;
-          } else if (process.platform === 'darwin') {
-            const r = spawnSync('pbcopy', [], { input: bodyText, stdio: ['pipe','ignore','ignore'] });
-            copied = r.status === 0;
-          }
-        } catch {}
-
-        // Open browser
-        try {
-          if (process.platform === 'win32') {
-            spawnSync('powershell', ['-NoProfile', '-Command', `Start-Process 'https://github.com/NeiP4n/promptgraph-registry/issues/new'`], { stdio: 'ignore' });
-          } else {
-            spawnSync(process.platform === 'darwin' ? 'open' : 'xdg-open', ['https://github.com/NeiP4n/promptgraph-registry/issues/new'], { stdio: 'ignore' });
-          }
-        } catch {}
-
-        console.log(chalk.bold('\n👉 Browser opened → github.com/NeiP4n/promptgraph-registry/issues/new'));
-        console.log('   Title: ' + chalk.cyan('Bundle: ' + name));
-        if (copied) {
-          console.log(chalk.green('✓ Description copied to clipboard — paste (Ctrl+V) into the body field, then Submit'));
-        } else {
-          console.log(chalk.yellow('\nPaste this into the body:\n') + chalk.gray(bodyText));
-        }
-      } else {
-        success(`Bundle proposed! Submit: ${result.submit_url}`);
-      }
+      success(`Bundle submitted: ${result.issue_url}`);
     }
     process.exit(0);
   }

package/commands/init.js

@@ -1,27 +1,27 @@
-import chalk from 'chalk';
-import { success, info } from '../cli.js';
-
-export default async function handler(args, bin) {
-  const { detectPlatforms } = await import('../platform.js');
-  const setupHandler = (await import('./setup.js')).default;
-
-  const detected = detectPlatforms();
-
-  if (detected.length === 0) {
-    info('No editor detected. Run: ' + chalk.white(`${bin} setup <platform>`));
-    info(chalk.gray('Platforms: claude-code, opencode, cursor, windsurf, cline, codex'));
-    process.exit(0);
-  }
-
-  if (detected.length === 1) {
-    info(`Detected: ${chalk.white(detected[0].name)}`);
-    await setupHandler([args[0], detected[0].id], bin);
-    return;
-  }
-
-  // Multiple editors — set up all, use first as primary skills dir
-  info(`Detected ${detected.length} editors:`);
-  for (const p of detected) info(`  ${chalk.white(p.id.padEnd(16))} ${chalk.gray(p.name)}`);
-  console.log();
-  await setupHandler([args[0], detected[0].id], bin);
-}
+import chalk from 'chalk';
+import { success, info } from '../cli.js';
+
+export default async function handler(args, bin) {
+  const { detectPlatforms } = await import('../platform.js');
+  const setupHandler = (await import('./setup.js')).default;
+
+  const detected = detectPlatforms();
+
+  if (detected.length === 0) {
+    info('No editor detected. Run: ' + chalk.white(`${bin} setup <platform>`));
+    info(chalk.gray('Platforms: claude-code, opencode, cursor, windsurf, cline, codex'));
+    process.exit(0);
+  }
+
+  if (detected.length === 1) {
+    info(`Detected: ${chalk.white(detected[0].name)}`);
+    await setupHandler([args[0], detected[0].id], bin);
+    return;
+  }
+
+  // Multiple editors — set up all, use first as primary skills dir
+  info(`Detected ${detected.length} editors:`);
+  for (const p of detected) info(`  ${chalk.white(p.id.padEnd(16))} ${chalk.gray(p.name)}`);
+  console.log();
+  await setupHandler([args[0], detected[0].id], bin);
+}

package/commands/install.js

@@ -1,40 +1,40 @@
-import chalk from 'chalk';
-import { success, error, info } from '../cli.js';
-
-export default async function handler(args, bin) {
-  const query = args.slice(1).join(' ').trim();
-  if (!query) {
-    console.log(chalk.yellow('Usage: ') + chalk.white(`${bin} install <bundle-name>`));
-    console.log(chalk.gray('  Examples:'));
-    console.log(chalk.gray(`    ${bin} install engineering-best-practices`));
-    console.log(chalk.gray(`    ${bin} install pg-000001`));
-    console.log(chalk.gray(`    ${bin} install "LLM Prompts"`));
-    console.log(chalk.gray(`\n  Browse: ${bin} marketplace\n`));
-    process.exit(1);
-  }
-
-  const { installBundle } = await import('../marketplace.js');
-  const ora = (await import('ora')).default;
-
-  const spinner = ora({ text: chalk.gray(`Installing "${query}"...`), color: 'magenta' }).start();
-  const result = await installBundle(query);
-  spinner.stop();
-
-  if (result.error) {
-    error(result.error);
-    console.log(chalk.gray(`  Try: ${bin} marketplace  (browse & search)`));
-    process.exit(1);
-  }
-
-  if (result.type === 'repo_import') {
-    success(`Installed ${chalk.white(result.bundle)}`);
-    info(chalk.gray(`Run ${chalk.white('pg reindex')} to enable semantic search`));
-  } else {
-    const ok = result.installed?.length ?? 0;
-    const fail = result.failed?.length ?? 0;
-    success(`Installed ${chalk.white(result.bundle)} — ${ok} skill${ok !== 1 ? 's' : ''}${fail > 0 ? chalk.red(` (${fail} failed)`) : ''}`);
-    if (ok > 0) info(chalk.gray(`Run ${chalk.white('pg reindex')} to enable semantic search`));
-  }
-
-  process.exit(0);
-}
+import chalk from 'chalk';
+import { success, error, info } from '../cli.js';
+
+export default async function handler(args, bin) {
+  const query = args.slice(1).join(' ').trim();
+  if (!query) {
+    console.log(chalk.yellow('Usage: ') + chalk.white(`${bin} install <bundle-name>`));
+    console.log(chalk.gray('  Examples:'));
+    console.log(chalk.gray(`    ${bin} install engineering-best-practices`));
+    console.log(chalk.gray(`    ${bin} install pg-000001`));
+    console.log(chalk.gray(`    ${bin} install "LLM Prompts"`));
+    console.log(chalk.gray(`\n  Browse: ${bin} marketplace\n`));
+    process.exit(1);
+  }
+
+  const { installBundle } = await import('../marketplace.js');
+  const ora = (await import('ora')).default;
+
+  const spinner = ora({ text: chalk.gray(`Installing "${query}"...`), color: 'magenta' }).start();
+  const result = await installBundle(query);
+  spinner.stop();
+
+  if (result.error) {
+    error(result.error);
+    console.log(chalk.gray(`  Try: ${bin} marketplace  (browse & search)`));
+    process.exit(1);
+  }
+
+  if (result.type === 'repo_import') {
+    success(`Installed ${chalk.white(result.bundle)}`);
+    info(chalk.gray(`Run ${chalk.white('pg reindex')} to enable semantic search`));
+  } else {
+    const ok = result.installed?.length ?? 0;
+    const fail = result.failed?.length ?? 0;
+    success(`Installed ${chalk.white(result.bundle)} — ${ok} skill${ok !== 1 ? 's' : ''}${fail > 0 ? chalk.red(` (${fail} failed)`) : ''}`);
+    if (ok > 0) info(chalk.gray(`Run ${chalk.white('pg reindex')} to enable semantic search`));
+  }
+
+  process.exit(0);
+}

package/commands/marketplace.js

@@ -44,7 +44,7 @@ export default async function handler(args, bin) {
   const { globSync } = await import('glob');
   const githubDir = path.join(SKILLS_STORE_DIR, 'github');
 
-  // For each bundle: if installed on disk — use real file count; otherwise use cache
+  // For each bundle: if installed on disk — use real file count + detect scripts; otherwise use cache
   const bundlesWithCounts = (Array.isArray(bundles) ? bundles : []).map(b => {
     if (!b.repo_url) return b;
     const owner = b.repo_url.split('/')[0];
@@ -52,8 +52,9 @@ export default async function handler(args, bin) {
     const clonedDir = path.join(githubDir, `${owner}-${repo}`);
     if (fs.existsSync(clonedDir) && fs.readdirSync(clonedDir).length > 0) {
       const realCount = globSync(`${clonedDir}/**/*.md`).length;
+      const hasScripts = globSync(`${clonedDir}/**/*.{py,sh,bash,js,ts,rb}`).length > 0;
       setCachedCount(b.repo_url, realCount);
-      return { ...b, skillCount: realCount };
+      return { ...b, skillCount: realCount, has_tools: b.has_tools || hasScripts };
     }
     const cached = getCachedCount(b.repo_url);
     return cached !== null ? { ...b, skillCount: cached } : b;

package/commands/setup.js

@@ -1,42 +1,42 @@
-import { colors, success, error, info, section } from '../cli.js';
-import chalk from 'chalk';
-
-export default async function handler(args, bin) {
-  const { detectPlatforms, PLATFORMS } = await import('../platform.js');
-  const { setupForPlatform, PLATFORM_SKILLS_DIRS } = await import('../config.js');
-  const { indexAll } = await import('../indexer.js');
-  const platformId = args[1];
-
-  if (!platformId) {
-    section('Detected platforms');
-    detectPlatforms().forEach(p => info(`${chalk.white(p.id.padEnd(16))} ${chalk.gray(p.name)}`));
-    console.log(chalk.gray('\n  Usage: pg setup <platform>\n'));
-    console.log(chalk.gray('  Platforms: claude-code, claude-desktop, opencode, cursor, windsurf, cline, codex\n'));
-    process.exit(0);
-  }
-
-  const platform = PLATFORMS[platformId];
-  if (!platform) { error(`Unknown platform: ${platformId}`); process.exit(1); }
-
-  // 1. Write MCP config
-  try {
-    platform.addMcp(platform);
-    success(`MCP registered in ${chalk.white(platform.name)}`);
-    info(chalk.gray(`  Config: ${platform.configPath}`));
-  } catch (e) {
-    error(`Failed to write MCP config: ${e.message}`);
-  }
-
-  // 2. Set skills dir for this platform
-  const config = setupForPlatform(platformId);
-  const skillsDir = config.skillsDir;
-  success(`Skills directory: ${chalk.white(skillsDir)}`);
-  info(chalk.gray('  Marketplace installs and pg import will save here'));
-
-  // 3. Reindex
-  console.log(chalk.gray('\n  Indexing skills...\n'));
-  await indexAll();
-
-  console.log(chalk.gray(`\n  Restart ${platform.name} to activate.\n`));
-  process.exit(0);
-}
+import { colors, success, error, info, section } from '../cli.js';
+import chalk from 'chalk';
+
+export default async function handler(args, bin) {
+  const { detectPlatforms, PLATFORMS } = await import('../platform.js');
+  const { setupForPlatform, PLATFORM_SKILLS_DIRS } = await import('../config.js');
+  const { indexAll } = await import('../indexer.js');
+  const platformId = args[1];
+
+  if (!platformId) {
+    section('Detected platforms');
+    detectPlatforms().forEach(p => info(`${chalk.white(p.id.padEnd(16))} ${chalk.gray(p.name)}`));
+    console.log(chalk.gray('\n  Usage: pg setup <platform>\n'));
+    console.log(chalk.gray('  Platforms: claude-code, claude-desktop, opencode, cursor, windsurf, cline, codex\n'));
+    process.exit(0);
+  }
+
+  const platform = PLATFORMS[platformId];
+  if (!platform) { error(`Unknown platform: ${platformId}`); process.exit(1); }
+
+  // 1. Write MCP config
+  try {
+    platform.addMcp(platform);
+    success(`MCP registered in ${chalk.white(platform.name)}`);
+    info(chalk.gray(`  Config: ${platform.configPath}`));
+  } catch (e) {
+    error(`Failed to write MCP config: ${e.message}`);
+  }
+
+  // 2. Set skills dir for this platform
+  const config = setupForPlatform(platformId);
+  const skillsDir = config.skillsDir;
+  success(`Skills directory: ${chalk.white(skillsDir)}`);
+  info(chalk.gray('  Marketplace installs and pg import will save here'));
+
+  // 3. Reindex
+  console.log(chalk.gray('\n  Indexing skills...\n'));
+  await indexAll();
+
+  console.log(chalk.gray(`\n  Restart ${platform.name} to activate.\n`));
+  process.exit(0);
+}

package/commands/update.js

@@ -35,17 +35,31 @@ export default async function handler(args, bin) {
 
   info(`Current: ${chalk.gray('v' + currentVersion)}  →  Latest: ${chalk.white.bold('v' + latest)}`);
 
-  // Kill other node processes that may lock native .node files (e.g. pg reindex still running)
-  // Exclude current PID to avoid killing ourselves
+  // Kill other promptgraph node processes that may lock native .node files
   if (process.platform === 'win32') {
-    spawnSync('wmic', ['process', 'where', `name='node.exe' and ProcessId!=${process.pid}`, 'delete'], { stdio: 'ignore', shell: true });
+    // taskkill is reliable on Windows 10/11 (wmic deprecated since Win11 22H2)
+    spawnSync('taskkill', ['/F', '/FI', `PID ne ${process.pid}`, '/FI', 'IMAGENAME eq node.exe'], { stdio: 'ignore', shell: true });
   } else {
     spawnSync('pkill', ['-f', 'promptgraph-mcp'], { stdio: 'ignore' });
   }
 
+  // Brief pause so OS releases file locks before npm touches them
+  await new Promise(r => setTimeout(r, 1500));
+
   const updateSpin = (await import('../cli.js')).spinner(`Installing promptgraph-mcp@latest (v${latest})...`);
   updateSpin.start();
-  const result = spawnSync('npm', ['install', '-g', 'promptgraph-mcp@latest'], { encoding: 'utf8', stdio: 'pipe', shell: true });
+
+  let result = spawnSync('npm', ['install', '-g', 'promptgraph-mcp@latest'], { encoding: 'utf8', stdio: 'pipe', shell: true });
+
+  // EBUSY: MCP server may have been re-spawned by the editor — retry once with --force
+  if (result.status !== 0 && (result.stderr || '').includes('EBUSY')) {
+    updateSpin.stop();
+    info('File busy (MCP server still running). Close Claude Code / your editor and press Enter to retry, or Ctrl+C to cancel.');
+    await new Promise(r => process.stdin.once('data', r));
+    updateSpin.start();
+    result = spawnSync('npm', ['install', '-g', 'promptgraph-mcp@latest', '--force'], { encoding: 'utf8', stdio: 'pipe', shell: true });
+  }
+
   updateSpin.stop();
 
   if (result.status !== 0) {

package/embed-cache.js

@@ -0,0 +1,71 @@
+// Persistent, content-addressed cache for embedding vectors.
+// Keyed by md5(modelTag + text) so re-indexing unchanged content — even after
+// the DB is wiped or rebuilt — never re-runs the (slow) ONNX model. On weak
+// devices this turns a full reindex from minutes into near-instant.
+import Database from 'better-sqlite3';
+import path from 'path';
+import fs from 'fs';
+import { createHash } from 'crypto';
+import { PROMPTGRAPH_DIR } from './config.js';
+
+const CACHE_PATH = path.join(PROMPTGRAPH_DIR, 'embed-cache.db');
+const MODEL_TAG = 'bge-small-en-v1.5';
+const ENABLED = !process.env.PG_NO_EMBED_CACHE;
+
+let _db = null;
+let _broken = false;
+let _stmtGet = null;
+let _stmtPut = null;
+
+function db() {
+  if (_db || _broken || !ENABLED) return _db;
+  try {
+    fs.mkdirSync(PROMPTGRAPH_DIR, { recursive: true });
+    _db = new Database(CACHE_PATH);
+    _db.pragma('journal_mode = WAL');
+    _db.pragma('synchronous = NORMAL');
+    _db.exec('CREATE TABLE IF NOT EXISTS embed_cache (hash TEXT PRIMARY KEY, vec BLOB NOT NULL)');
+    _stmtGet = _db.prepare('SELECT vec FROM embed_cache WHERE hash = ?');
+    _stmtPut = _db.prepare('INSERT OR IGNORE INTO embed_cache (hash, vec) VALUES (?, ?)');
+  } catch {
+    _broken = true; // disk full / locked / unsupported — silently fall back to no-cache
+    _db = null;
+  }
+  return _db;
+}
+
+export function hashText(text) {
+  return createHash('md5').update(MODEL_TAG).update('\0').update(text).digest('hex');
+}
+
+function vecToBlob(vec) {
+  return Buffer.from(new Float32Array(vec).buffer);
+}
+
+function blobToVec(buf) {
+  return Array.from(new Float32Array(buf.buffer, buf.byteOffset, buf.length / 4));
+}
+
+// Look up many hashes at once → Map<hash, number[]>. Missing keys are absent.
+export function cacheGetMany(hashes) {
+  const out = new Map();
+  if (!db()) return out;
+  try {
+    for (const h of hashes) {
+      const row = _stmtGet.get(h);
+      if (row) out.set(h, blobToVec(row.vec));
+    }
+  } catch {}
+  return out;
+}
+
+// Persist [hash, number[]] pairs. Best-effort; failures are swallowed.
+export function cachePutMany(entries) {
+  if (!db() || entries.length === 0) return;
+  try {
+    const tx = _db.transaction(rows => {
+      for (const [h, vec] of rows) _stmtPut.run(h, vecToBlob(vec));
+    });
+    tx(entries);
+  } catch {}
+}

package/embedder.js

@@ -1,12 +1,22 @@
 import { EmbeddingModel, FlagEmbedding } from 'fastembed';
 import path from 'path';
 import os from 'os';
+import { hashText, cacheGetMany, cachePutMany } from './embed-cache.js';
 
 const CACHE_DIR = path.join(os.homedir(), '.claude', '.promptgraph', 'model-cache');
 const BATCH_SIZE = 256;
 const MAX_EMBEDDING_CALLS = 1_000_000;
 let embedCallCount = 0;
 
+// Embedding batch passed to fastembed. onnxruntime's CPU arena scales ~linearly
+// with batch size, while CPU throughput is essentially batch-independent
+// (~0.26s/text either way). Measured on this model: batch 16 → ~0.7 GB peak,
+// 32 → ~1.2 GB, 64 → ~2.6 GB, 256 → ~5.8 GB, all at the same speed. So a small
+// batch is strictly better — same wall-clock, far less RAM — which is what lets
+// a first index run on a weak (2-4 GB) device without OOM/swap. Default 16;
+// override with PG_EMBED_BATCH (larger only trades RAM for nothing on CPU).
+const EMBED_BATCH = Math.max(1, parseInt(process.env.PG_EMBED_BATCH, 10) || 16);
+
 export function getEmbedCallCount() { return embedCallCount; }
 export function resetEmbedCallCount() { embedCallCount = 0; }
 
@@ -22,30 +32,82 @@ async function getModel() {
   return model;
 }
 
+// Release the embedding model so its ~2 GB arena can be reclaimed. Safe to call
+// once embedding is done (e.g. before building the ANN index); getModel() will
+// transparently re-init on the next embed.
+export function freeModel() {
+  model = null;
+}
+
 export async function embed(text) {
-  embedCallCount++;
-  const m = await getModel();
-  const results = [];
-  for await (const batch of m.embed([text])) {
-    results.push(...batch);
-  }
-  return Array.from(results[0]);
+  const [v] = await embedBatch([text]);
+  return v;
 }
 
+// Embed `texts`, returning a vector per input in order.
+// Two layers cut the ONNX work that dominates indexing on slow devices:
+//   1. dedup — identical texts (common boilerplate across a skill collection)
+//      are embedded once and fanned back out to every position.
+//   2. persistent cache — unique texts already embedded in a prior run are read
+//      from disk, so a full reindex of unchanged content runs the model zero times.
 export async function embedBatch(texts, onProgress) {
-  if (embedCallCount + texts.length > MAX_EMBEDDING_CALLS) {
+  const n = texts.length;
+  if (embedCallCount + n > MAX_EMBEDDING_CALLS) {
     throw new Error(`Embedding queue limit exceeded (max ${MAX_EMBEDDING_CALLS} chunks per session). Use --fast or reindex incrementally.`);
   }
-  embedCallCount += texts.length;
-  const m = await getModel();
-  const all = [];
+  embedCallCount += n;
+
+  const out = new Array(n);
+  if (n === 0) return out;
+
+  // 1. group input positions by content hash (dedup)
+  const groups = new Map(); // hash -> { text, positions: number[] }
+  const order = [];
+  for (let i = 0; i < n; i++) {
+    const h = hashText(texts[i]);
+    let g = groups.get(h);
+    if (!g) { g = { text: texts[i], positions: [] }; groups.set(h, g); order.push(h); }
+    g.positions.push(i);
+  }
+
+  // 2. fill from the persistent cache; collect misses to embed
+  const cached = cacheGetMany(order);
+  const missHashes = [];
+  const missTexts = [];
   let done = 0;
-  for await (const batch of m.embed(texts)) {
-    all.push(...batch);
-    done += batch.length;
-    if (onProgress) onProgress(done, texts.length);
+  for (const h of order) {
+    const g = groups.get(h);
+    const v = cached.get(h);
+    if (v) {
+      for (const p of g.positions) out[p] = v;
+      done += g.positions.length;
+    } else {
+      missHashes.push(h);
+      missTexts.push(g.text);
+    }
   }
-  return all.map(v => Array.from(v));
+  if (onProgress && done > 0) onProgress(Math.min(done, n), n);
+
+  // 3. run the model only on cache misses, then persist them
+  if (missTexts.length > 0) {
+    const m = await getModel();
+    const toPersist = [];
+    let mi = 0;
+    for await (const batch of m.embed(missTexts, EMBED_BATCH)) {
+      for (const raw of batch) {
+        const vec = Array.from(raw);
+        const h = missHashes[mi++];
+        const g = groups.get(h);
+        for (const p of g.positions) out[p] = vec;
+        toPersist.push([h, vec]);
+        done += g.positions.length;
+      }
+      if (onProgress) onProgress(Math.min(done, n), n);
+    }
+    cachePutMany(toPersist);
+  }
+
+  return out;
 }
 
 export function cosineSimilarity(a, b) {

package/github-import.js

@@ -57,10 +57,20 @@ function streamDownload(url, maxSize = MAX_DOWNLOAD_SIZE, redirects = 0) {
   })
 }
 
+function getGhToken() {
+  const envToken = process.env.GITHUB_TOKEN;
+  if (envToken) return envToken;
+  try {
+    const r = spawnSync('gh', ['auth', 'token'], { encoding: 'utf8', timeout: 5000 });
+    if (r.status === 0 && r.stdout.trim()) return r.stdout.trim();
+  } catch {}
+  return null;
+}
+
 async function httpsGet(url, redirects = 0) {
   if (redirects > 5) return Promise.reject(new Error('Too many redirects'))
   await githubRateLimiter.acquire()
-  const token = process.env.GITHUB_TOKEN;
+  const token = getGhToken();
   const headers = { 'User-Agent': 'promptgraph-mcp' };
   if (token && url.startsWith('https://api.github.com/')) headers['Authorization'] = `Bearer ${token}`;
   return new Promise((res, rej) => {
@@ -228,8 +238,12 @@ async function detectSkillsDirFromAPI(ownerRepo) {
     }
     if (best) return { subdir: best, label: best };
 
+    // 3. Root-level .md files (no subdirectory, skills live at repo root)
+    const rootMd = entries.filter(e => e.type === 'file' && e.name.endsWith('.md') && !SKIP_RE.test(e.name.replace(/\.md$/i, '').toLowerCase()));
+    if (rootMd.length >= 1) return { subdir: null, label: 'root' };
+
   } catch {}
-  return null; // no good subdir found — use root
+  return null; // repo not found or inaccessible
 }
 
 const SKIP_DIRS_API = new Set([
@@ -273,6 +287,9 @@ function sparseClone(url, dest, subdir) {
   return false;
 }
 
+// Script extensions to preserve during cleanup (sparse-checkout fetches them alongside .md)
+const SCRIPT_EXTS = new Set(['.py', '.sh', '.bash', '.js', '.ts', '.rb']);
+
 // Shared skip patterns — module scope so both cleanup functions can access them
 const SKIP_RE = /^(readme|changelog|license|contributing|code.of.conduct|security|authors|credits|install|installation|usage|promotion|faq|glossary|index|overview|summary|roadmap|todo|notes|template|example|sample|demo|guide|tutorial|walkthrough|architecture|design|spec|requirements|privacy|terms|disclaimer|notice|copying|warranty|funding|claude|bugs?\b|feature.?request)/i;
 const SKIP_DIRS_LOCAL = new Set([
@@ -306,7 +323,8 @@ function cleanupRepoRoot(repoRoot) {
         removed++;
       }
     } else if (entry.isFile() && !entry.name.endsWith('.md')) {
-      if (entry.name !== '.gitignore') {
+      const ext = path.extname(entry.name).toLowerCase();
+      if (entry.name !== '.gitignore' && !SCRIPT_EXTS.has(ext)) {
         try { fs.unlinkSync(fullPath); removed++; } catch {}
       }
     }
@@ -337,7 +355,8 @@ function cleanupRepoDir(dirPath, SKIP_RE) {
         removed++;
       }
     } else if (entry.isFile() && !entry.name.endsWith('.md')) {
-      try { fs.unlinkSync(fullPath); removed++; } catch {}
+      const ext = path.extname(entry.name).toLowerCase();
+      if (!SCRIPT_EXTS.has(ext)) { try { fs.unlinkSync(fullPath); removed++; } catch {} }
     }
   }
   return removed;
@@ -714,13 +733,20 @@ export async function importFromGitHubLight(repoUrl) {
   prog(`Detecting skill directory...`);
   const subdir = detectSubdirFromTree(destBase);
 
-  // Step 3: sparse-checkout only the skills subdir .md files
+  // Step 3: sparse-checkout skills subdir — .md files + scripts (.py/.sh/.js/.ts/.rb/.bash)
   prog(`Setting up sparse checkout${subdir ? ` (${subdir}/)` : ''}...`);
   spawnSync('git', ['-C', destBase, 'sparse-checkout', 'init'], { stdio: 'pipe', env: gitEnv });
   if (subdir) {
-    spawnSync('git', ['-C', destBase, 'sparse-checkout', 'set', '--no-cone', `${subdir}/*.md`, `${subdir}/**/*.md`], { stdio: 'pipe', env: gitEnv });
+    spawnSync('git', ['-C', destBase, 'sparse-checkout', 'set', '--no-cone',
+      `${subdir}/*.md`, `${subdir}/**/*.md`,
+      `${subdir}/**/*.py`, `${subdir}/**/*.sh`, `${subdir}/**/*.js`,
+      `${subdir}/**/*.ts`, `${subdir}/**/*.rb`, `${subdir}/**/*.bash`,
+    ], { stdio: 'pipe', env: gitEnv });
   } else {
-    spawnSync('git', ['-C', destBase, 'sparse-checkout', 'set', '--no-cone', '*.md', '**/*.md'], { stdio: 'pipe', env: gitEnv });
+    spawnSync('git', ['-C', destBase, 'sparse-checkout', 'set', '--no-cone',
+      '*.md', '**/*.md',
+      '**/*.py', '**/*.sh', '**/*.js', '**/*.ts', '**/*.rb', '**/*.bash',
+    ], { stdio: 'pipe', env: gitEnv });
   }
 
   // Step 4: checkout to materialize only the selected files
@@ -735,6 +761,14 @@ export async function importFromGitHubLight(repoUrl) {
   spawnSync('git', ['-C', destBase, 'checkout', 'HEAD', '--', '.'], { stdio: 'pipe', env: gitEnv, timeout: 120000 });
   process.stderr.write('\n');
 
+  // Make scripts executable on unix
+  if (process.platform !== 'win32') {
+    try {
+      const scripts = globSync(`${destBase}/**/*.{py,sh,bash,js,ts,rb}`, { absolute: true });
+      for (const s of scripts) { try { fs.chmodSync(s, 0o755); } catch {} }
+    } catch {}
+  }
+
   // Step 5: filter out non-skill files locally
   const allMd = globSync(`${destBase}/**/*.md`);
   prog(`Filtering ${allMd.length} files...`);

package/index.js

@@ -211,7 +211,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'pg_marketplace_publish',
-      description: 'Publish a local skill file to the marketplace via GitHub Gist.',
+      description: 'Publish a local skill file to the marketplace. Requires an authenticated GitHub CLI (gh auth login); creates a Gist and auto-submits the registry issue — no manual step.',
       inputSchema: {
         type: 'object',
         properties: { file_path: { type: 'string' } },
@@ -256,7 +256,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
     },
     {
       name: 'pg_bundle_publish',
-      description: 'Publish a bundle definition to GitHub Gist and get a registry submission link. Pass a JSON object or path to a .json file.',
+      description: 'Publish a bundle definition to the marketplace. Requires an authenticated GitHub CLI (gh auth login); auto-submits the registry issue with the bundle JSON — no manual step. Pass a JSON object or path to a .json file.',
       inputSchema: {
         type: 'object',
         properties: {

package/indexer.js

@@ -3,7 +3,7 @@ import { createHash } from 'crypto';
 import fs from 'fs';
 import path from 'path';
 import { parseSkillFile, isSkillFile, filterWithClassifier } from './parser.js';
-import { embedBatch, cosineSimilarity } from './embedder.js';
+import { embedBatch, cosineSimilarity, freeModel } from './embedder.js';
 import { BATCH_SIZE } from './config.js';
 import { getDb, skillId, vecToBlob } from './db.js';
 import { loadConfig } from './config.js';
@@ -257,6 +257,7 @@ export async function indexAll({ fast = false } = {}) {
   progress(total, total, { skipped, errors });
   progressDone();
   if (!fast) {
+    freeModel(); // release the embedding model's arena before the ANN build
     const spin = spinner('Building ANN index...');
     spin.start();
     await buildAnnIndex();

package/marketplace.js

@@ -280,9 +280,9 @@ async function countRepoSkills(repoUrl) {
 }
 
 // Count real .md files on disk for an installed bundle (always correct)
-function localSkillCount(repoUrl) {
+export function localSkillCount(repoUrl) {
   const repoName = repoUrl.replace(/^https?:\/\/github\.com\//, '').replace(/\.git$/, '').replace('/', '-');
-  const dest = path.join(SKILLS_STORE_DIR, 'github', repoName);
+  const dest = path.join(getSkillsStoreDir(), 'github', repoName);
   if (!fs.existsSync(dest)) return null;
   const files = globSync(`${dest}/**/*.md`);
   return files.length;
@@ -510,6 +510,25 @@ export async function installBundleBg(bundleId, onDone) {
   return { queued: true, id: bundle.id, name: bundle.name };
 }
 
+// Publishing to the marketplace requires an authenticated GitHub CLI account.
+// `gh auth status` exits 0 only when a user is logged in; ENOENT means gh is
+// not installed. Returns { ok: true } or { ok: false, error } with guidance.
+export function requireGhAuth() {
+  let res;
+  try {
+    res = spawnSync('gh', ['auth', 'status'], { encoding: 'utf8', timeout: 10000 });
+  } catch {
+    res = { error: { code: 'ENOENT' } };
+  }
+  if (res.error?.code === 'ENOENT') {
+    return { ok: false, error: 'Publishing requires the GitHub CLI. Install it from https://cli.github.com, then run: gh auth login' };
+  }
+  if (res.status !== 0) {
+    return { ok: false, error: 'Publishing requires a signed-in GitHub account. Run: gh auth login' };
+  }
+  return { ok: true };
+}
+
 function ghPublish(filePath, desc) {
   try {
     const result = spawnSync('gh', ['gist', 'create', filePath, '--desc', desc, '--public'], { encoding: 'utf8' });
@@ -521,7 +540,22 @@ function ghPublish(filePath, desc) {
   }
 }
 
-const REGISTRY_ISSUES = 'https://github.com/NeiP4n/promptgraph-registry/issues/new';
+const REGISTRY_REPO = 'NeiP4n/promptgraph-registry';
+const REGISTRY_ISSUES = `https://github.com/${REGISTRY_REPO}/issues/new`;
+
+// Open the registry submission issue automatically via the authenticated gh CLI.
+// Removes the manual "open browser → paste → submit" step. `gh issue create`
+// prints the new issue URL to stdout. Returns { ok, url } or { ok:false, error }.
+function ghCreateIssue(title, body) {
+  try {
+    const r = spawnSync('gh', ['issue', 'create', '--repo', REGISTRY_REPO, '--title', title, '--body', body], { encoding: 'utf8', timeout: 20000 });
+    if (r.error?.code === 'ENOENT') return { ok: false, no_gh: true };
+    if (r.status !== 0) return { ok: false, error: r.stderr?.trim() || 'gh issue create failed' };
+    return { ok: true, url: r.stdout.trim() };
+  } catch (e) {
+    return { ok: false, error: e.message };
+  }
+}
 
 export async function publishSkill(filePath) {
   if (!fs.existsSync(filePath)) return { error: `File not found: ${filePath}` };
@@ -531,25 +565,21 @@ export async function publishSkill(filePath) {
     return { error: 'Validation failed', issues: validation.errors, warnings: validation.warnings };
   }
 
+  const auth = requireGhAuth();
+  if (!auth.ok) return { error: auth.error };
+
   const name = path.basename(filePath, '.md');
   const gh = ghPublish(filePath, `PromptGraph skill: ${name}`);
 
-  if (gh.no_gh) {
-    const content = fs.readFileSync(filePath, 'utf8');
-    return {
-      success: true,
-      gh_not_installed: true,
-      instructions: [
-        '1. Install gh CLI: https://cli.github.com',
-        '   OR manually create a public Gist at https://gist.github.com with the file content',
-        `2. Submit to registry: ${REGISTRY_ISSUES}`,
-        `3. Paste the Gist URL in the issue`,
-      ].join('\n'),
-      file_content: content,
-    };
-  }
+  if (gh.no_gh) return { error: 'GitHub CLI became unavailable. Install it from https://cli.github.com and run: gh auth login' };
   if (!gh.ok) return { error: gh.error };
-  return { success: true, url: gh.url, message: `Published! Submit to registry: ${REGISTRY_ISSUES}` };
+
+  // Auto-submit the registry issue — no manual step needed.
+  const issue = ghCreateIssue(`Skill: ${name}`, `Skill submission (gist): ${gh.url}`);
+  if (!issue.ok) {
+    return { success: true, gist_url: gh.url, submitted: false, submit_url: REGISTRY_ISSUES, message: `Gist published (${gh.url}) but auto-submit failed: ${issue.error || 'gh unavailable'}. Submit manually: ${REGISTRY_ISSUES}` };
+  }
+  return { success: true, gist_url: gh.url, submitted: true, issue_url: issue.url, message: `Published & submitted: ${issue.url}` };
 }
 
 export async function publishBundle(bundleDef) {
@@ -567,6 +597,9 @@ export async function publishBundle(bundleDef) {
     return { error: 'Bundle validation failed', issues: validation.errors, warnings: validation.warnings };
   }
 
+  const auth = requireGhAuth();
+  if (!auth.ok) return { error: auth.error };
+
   // Best-effort repo validation (client-side). GitHub Actions is the source of truth.
   let repoWarnings = [];
   if (def.repo_url) {
@@ -582,38 +615,23 @@ export async function publishBundle(bundleDef) {
   }
 
   const bundleJson = JSON.stringify(def, null, 2);
-  const tmpFile = path.join(PROMPTGRAPH_DIR, `bundle-${def.id}.json`);
-  fs.mkdirSync(PROMPTGRAPH_DIR, { recursive: true });
-  fs.writeFileSync(tmpFile, bundleJson);
-
-  const gh = ghPublish(tmpFile, `PromptGraph bundle: ${def.name}`);
-  try { fs.unlinkSync(tmpFile); } catch {}
-
-  if (gh.no_gh) {
-    const compactJson = JSON.stringify(def);
-    const issueUrl = `${REGISTRY_ISSUES}?title=Bundle%3A+${encodeURIComponent(def.name)}&body=${encodeURIComponent('Bundle definition:\n\n```json\n' + compactJson + '\n```')}`;
-    const actionNote = def.repo_url ? `\n\nNote: Your repo will be validated by CI (GitHub Actions) after submission.\nRun locally: node validate-repo-action.js ${def.repo_url}` : '';
-    return {
-      success: true,
-      gh_not_installed: true,
-      instructions: [
-        `👉 Open this link and click "Submit new issue" (JSON is already filled in):`,
-        `   ${issueUrl}`,
-        '',
-        '   OR install gh CLI for one-command submit: https://cli.github.com',
-        ...(repoWarnings.length ? ['', '⚠ Repo warnings (CI will re-check):', ...repoWarnings.map(w => '   - ' + w)] : []),
-        ...(def.repo_url ? ['', 'Your repo will be validated by CI when submitted.'] : []),
-      ].join('\n'),
-      bundle_json: bundleJson,
-      submit_url: issueUrl,
-    };
-  }
-  if (!gh.ok) return { error: gh.error };
-  const issueUrl = `${REGISTRY_ISSUES}?title=Bundle%3A+${encodeURIComponent(def.name)}&body=Gist%3A+${encodeURIComponent(gh.url)}`;
-  const msg = def.repo_url
-    ? `Bundle published! Submit: ${issueUrl}\n\nRepo will be validated by CI. Run: node validate-repo-action.js ${def.repo_url}`
-    : `Bundle published! Submit: ${issueUrl}`;
-  return { success: true, gist_url: gh.url, submit_url: issueUrl, message: msg };
+
+  // Auto-submit: create the registry issue directly with the bundle JSON inline
+  // (the format the registry bot parses) — no manual browser/paste step.
+  const body = [
+    'Bundle definition:',
+    '',
+    '```json',
+    bundleJson,
+    '```',
+    ...(def.repo_url ? ['', 'Repo will be validated by CI (GitHub Actions) on submission.'] : []),
+    ...(repoWarnings.length ? ['', '⚠ Client-side repo warnings (CI re-checks):', ...repoWarnings.map(w => `- ${w}`)] : []),
+  ].join('\n');
+
+  const issue = ghCreateIssue(`Bundle: ${def.name}`, body);
+  if (issue.no_gh) return { error: 'GitHub CLI became unavailable. Install it from https://cli.github.com and run: gh auth login' };
+  if (!issue.ok) return { error: `Auto-submit failed: ${issue.error}` };
+  return { success: true, submitted: true, issue_url: issue.url, message: `Bundle submitted: ${issue.url}`, warnings: repoWarnings };
 }
 
 export function getTopRated(topK = 10) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "promptgraph-mcp",
-  "version": "2.9.43",
+  "version": "2.9.46",
   "files": [
     "*.js",
     "commands/",
@@ -61,6 +61,6 @@
     "vitest": "^4.1.8"
   },
   "overrides": {
-    "tar": "^7.5.11"
+    "tar": "^6.2.0"
   }
 }

package/validator.js

@@ -56,7 +56,7 @@ export function validateSkill(filePath) {
   } else if (typeof data.name !== 'string') {
     errors.push('Field "name" must be a string');
   } else if (!NAME_RE.test(data.name)) {
-    errors.push(`Invalid name "${data.name}". Use lowercase, digits, hyphens (2-64 chars).`);
+    warnings.push(`Invalid name "${data.name}" — will be derived from filename instead.`);
   }
 
   // description — derive from first paragraph if missing