promptgraph-mcp 2.9.47 → 2.9.48

package/commands/bundle.js

@@ -107,14 +107,36 @@ export default async function handler(args, bin) {
       );
       process.exit(1);
     }
-    const { validMdCount, hasScripts } = detected;
-    console.log(chalk.green(`found: ${detected.label}/`) + chalk.gray(` (${validMdCount} valid skills${hasScripts ? ', has scripts 🔧' : ''})`));
+    const { validMdCount, hasScripts: hasScriptsQuick } = detected;
+    console.log(chalk.green(`found: ${detected.label}/`) + chalk.gray(` (~${validMdCount} skills by name)`));
 
     if (validMdCount === 0) {
       error(`Cannot publish: ${repo}/${detected.label} has no skills that pass validation.\n  All .md files were filtered (README/changelog/docs/etc).`);
       process.exit(1);
     }
 
+    // Deep validation: fetch each file via raw (free) + validateSkill on content
+    const { deepValidateRepo: _deepVal } = await import('../github-import.js');
+    process.stdout.write(chalk.gray(`  Validating skill content (${validMdCount} files)... `));
+    let deepResult;
+    try {
+      deepResult = await _deepVal(repo, detected.subdir, (done, total) => {
+        process.stdout.write(`\r  Validating skill content: ${done}/${total}... `);
+      });
+    } catch (e) {
+      process.stdout.write('\n');
+      error(`Validation failed: ${e.message}`); process.exit(1);
+    }
+    process.stdout.write('\n');
+
+    if (deepResult.passed === 0) {
+      error(`Cannot publish: all ${deepResult.total} skill files failed content validation (too short, security patterns, etc).`);
+      process.exit(1);
+    }
+
+    const hasScripts = hasScriptsQuick || deepResult.hasScripts;
+    console.log(chalk.green(`  ✓ ${deepResult.passed}/${deepResult.total} skills valid${hasScripts ? '  🔧 scripts detected' : ''}`));
+
     const name = repo.split('/')[1].replace(/-/g, ' ').replace(/\b\w/g, c => c.toUpperCase());
     const id = repo.replace('/', '-').toLowerCase();
     const bundle = {

package/github-import.js

@@ -265,6 +265,48 @@ async function detectSkillsDirFromAPI(ownerRepo) {
   return null; // repo not found or inaccessible
 }
 
+// Deep-validate a repo bundle via 1 API call (tree) + raw file fetches (not rate-limited).
+// Returns { passed, total, hasScripts } — passed = skills that survive validateSkill().
+export async function deepValidateRepo(ownerRepo, subdir, onProgress) {
+  const treeJson = await httpsGet(`https://api.github.com/repos/${ownerRepo}/git/trees/HEAD?recursive=1`);
+  const tree = JSON.parse(treeJson);
+
+  const prefix = subdir ? `${subdir}/` : '';
+  const allBlobs = (tree.tree || []).filter(f => f.type === 'blob');
+
+  const mdFiles = allBlobs.filter(f =>
+    f.path.startsWith(prefix) &&
+    f.path.endsWith('.md') &&
+    !SKIP_RE.test(path.basename(f.path, '.md').toLowerCase())
+  );
+
+  const hasScripts = allBlobs.some(f =>
+    f.path.startsWith(prefix) && SCRIPT_EXTS.has(path.extname(f.path).toLowerCase())
+  );
+
+  const tmpDir = fs.mkdtempSync(path.join(PROMPTGRAPH_DIR, 'pg-val-'));
+  let passed = 0;
+  const total = mdFiles.length;
+
+  try {
+    for (let i = 0; i < mdFiles.length; i++) {
+      const f = mdFiles[i];
+      if (onProgress) onProgress(i + 1, total);
+      try {
+        const rawUrl = `https://raw.githubusercontent.com/${ownerRepo}/HEAD/${f.path}`;
+        const content = await streamDownload(rawUrl);
+        const tmpFile = path.join(tmpDir, `skill-${i}.md`);
+        fs.writeFileSync(tmpFile, content);
+        if (validateSkill(tmpFile).ok) passed++;
+      } catch {}
+    }
+  } finally {
+    try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
+  }
+
+  return { passed, total, hasScripts };
+}
+
 const SKIP_DIRS_API = new Set([
   '.github', 'docs', 'doc', 'documentation', 'examples', 'example',
   'tests', 'test', 'assets', 'images', 'img', 'media', 'static',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "promptgraph-mcp",
-  "version": "2.9.47",
+  "version": "2.9.48",
   "files": [
     "*.js",
     "commands/",