promptgraph-mcp 2.9.47 → 2.9.49

package/commands/bundle.js

@@ -107,14 +107,36 @@ export default async function handler(args, bin) {
       );
       process.exit(1);
     }
-    const { validMdCount, hasScripts } = detected;
-    console.log(chalk.green(`found: ${detected.label}/`) + chalk.gray(` (${validMdCount} valid skills${hasScripts ? ', has scripts 🔧' : ''})`));
+    const { validMdCount, hasScripts: hasScriptsQuick } = detected;
+    console.log(chalk.green(`found: ${detected.label}/`) + chalk.gray(` (~${validMdCount} skills by name)`));
 
     if (validMdCount === 0) {
       error(`Cannot publish: ${repo}/${detected.label} has no skills that pass validation.\n  All .md files were filtered (README/changelog/docs/etc).`);
       process.exit(1);
     }
 
+    // Deep validation: fetch each file via raw (free) + validateSkill on content
+    const { deepValidateRepo: _deepVal } = await import('../github-import.js');
+    process.stdout.write(chalk.gray(`  Validating skill content (${validMdCount} files)... `));
+    let deepResult;
+    try {
+      deepResult = await _deepVal(repo, detected.subdir, (done, total) => {
+        process.stdout.write(`\r  Validating skill content: ${done}/${total}... `);
+      });
+    } catch (e) {
+      process.stdout.write('\n');
+      error(`Validation failed: ${e.message}`); process.exit(1);
+    }
+    process.stdout.write('\n');
+
+    if (deepResult.passed === 0) {
+      error(`Cannot publish: all ${deepResult.total} skill files failed content validation (too short, security patterns, etc).`);
+      process.exit(1);
+    }
+
+    const hasScripts = hasScriptsQuick || deepResult.hasScripts;
+    console.log(chalk.green(`  ✓ ${deepResult.passed}/${deepResult.total} skills valid${hasScripts ? '  🔧 scripts detected' : ''}`));
+
     const name = repo.split('/')[1].replace(/-/g, ' ').replace(/\b\w/g, c => c.toUpperCase());
     const id = repo.replace('/', '-').toLowerCase();
     const bundle = {
@@ -122,6 +144,8 @@ export default async function handler(args, bin) {
       description: `Skills from ${repo}`,
       tags: ['community'],
       stars: 0,
+      skill_count: deepResult.passed,
+      validated: true,
       ...(hasScripts && { has_tools: true }),
     };
     const json = JSON.stringify(bundle, null, 2);

package/commands/marketplace.js

@@ -57,7 +57,8 @@ export default async function handler(args, bin) {
       return { ...b, skillCount: realCount, has_tools: b.has_tools || hasScripts };
     }
     const cached = getCachedCount(b.repo_url);
-    return cached !== null ? { ...b, skillCount: cached } : b;
+    const knownCount = cached ?? b.skill_count ?? null;
+    return knownCount !== null ? { ...b, skillCount: knownCount } : b;
   });
   refreshCountsInBackground(bundlesWithCounts);
 

package/github-import.js

@@ -53,6 +53,7 @@ function streamDownload(url, maxSize = MAX_DOWNLOAD_SIZE, redirects = 0) {
       })
       r.on('end', () => res(chunks.join('')))
     })
+    req.setTimeout(30000, () => req.destroy(new Error('streamDownload timeout')))
     req.on('error', rej)
   })
 }
@@ -80,6 +81,7 @@ async function httpsGet(url, redirects = 0) {
       if (r.statusCode !== 200) { r.resume(); return rej(new Error(`HTTP ${r.statusCode}`)); }
       const chunks = []; r.setEncoding('utf8'); r.on('data', c => chunks.push(c)); r.on('end', () => res(chunks.join('')));
     });
+    req.setTimeout(30000, () => req.destroy(new Error('httpsGet timeout')));
     req.on('error', rej);
   });
 }
@@ -265,6 +267,48 @@ async function detectSkillsDirFromAPI(ownerRepo) {
   return null; // repo not found or inaccessible
 }
 
+// Deep-validate a repo bundle via 1 API call (tree) + raw file fetches (not rate-limited).
+// Returns { passed, total, hasScripts } — passed = skills that survive validateSkill().
+export async function deepValidateRepo(ownerRepo, subdir, onProgress) {
+  const treeJson = await httpsGet(`https://api.github.com/repos/${ownerRepo}/git/trees/HEAD?recursive=1`);
+  const tree = JSON.parse(treeJson);
+
+  const prefix = subdir ? `${subdir}/` : '';
+  const allBlobs = (tree.tree || []).filter(f => f.type === 'blob');
+
+  const mdFiles = allBlobs.filter(f =>
+    f.path.startsWith(prefix) &&
+    f.path.endsWith('.md') &&
+    !SKIP_RE.test(path.basename(f.path, '.md').toLowerCase())
+  );
+
+  const hasScripts = allBlobs.some(f =>
+    f.path.startsWith(prefix) && SCRIPT_EXTS.has(path.extname(f.path).toLowerCase())
+  );
+
+  const tmpDir = fs.mkdtempSync(path.join(PROMPTGRAPH_DIR, 'pg-val-'));
+  let passed = 0;
+  const total = mdFiles.length;
+
+  try {
+    for (let i = 0; i < mdFiles.length; i++) {
+      const f = mdFiles[i];
+      if (onProgress) onProgress(i + 1, total);
+      try {
+        const rawUrl = `https://raw.githubusercontent.com/${ownerRepo}/HEAD/${f.path}`;
+        const content = await streamDownload(rawUrl);
+        const tmpFile = path.join(tmpDir, `skill-${i}.md`);
+        fs.writeFileSync(tmpFile, content);
+        if (validateSkill(tmpFile).ok) passed++;
+      } catch {}
+    }
+  } finally {
+    try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
+  }
+
+  return { passed, total, hasScripts };
+}
+
 const SKIP_DIRS_API = new Set([
   '.github', 'docs', 'doc', 'documentation', 'examples', 'example',
   'tests', 'test', 'assets', 'images', 'img', 'media', 'static',

package/marketplace.js

@@ -314,12 +314,16 @@ export async function browseBundles(topK = 20) {
         return;
       }
 
-      // 2. Not installed — use cached API count if fresh
+      // 2. Not installed — validated registry count is authoritative; use cache if fresh
       const cached = cache[b.repo_url];
       if (cached && (now - cached.ts) < SKILL_COUNT_TTL) {
         b.skillCount = cached.count;
         return;
       }
+      if (b.validated && b.skill_count) {
+        b.skillCount = b.skill_count;
+        return;
+      }
 
       // 3. Fetch from GitHub API
       const count = await countRepoSkills(b.repo_url);
@@ -328,7 +332,7 @@ export async function browseBundles(topK = 20) {
         cache[b.repo_url] = { count, ts: now };
         changed = true;
       } else {
-        b.skillCount = cached?.count ?? b.skillCount ?? 0;
+        b.skillCount = cached?.count ?? b.skill_count ?? 0;
       }
     }));
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "promptgraph-mcp",
-  "version": "2.9.47",
+  "version": "2.9.49",
   "files": [
     "*.js",
     "commands/",

package/tui.js

@@ -50,7 +50,7 @@ function buildItems(skills, bundles) {
     items.push({ type: 'skill', id: s.id, name: s.name || s.id, description: s.description || '', category: s.category || 'Community', tags: s.tags || [], stars: s.stars || 0, code: s.code, created_at: s.created_at || null });
   }
   for (const b of bundles) {
-    items.push({ type: 'bundle', id: b.id, name: b.name || b.id, description: b.description || '', category: b.category || 'Community', tags: b.tags || [], stars: b.stars || 0, skillCount: b.skillCount, repo_url: b.repo_url, skills: b.skills, has_tools: b.has_tools || false, created_at: b.created_at || null });
+    items.push({ type: 'bundle', id: b.id, name: b.name || b.id, description: b.description || '', category: b.category || 'Community', tags: b.tags || [], stars: b.stars || 0, skillCount: b.skillCount, validated: b.validated || false, repo_url: b.repo_url, skills: b.skills, has_tools: b.has_tools || false, created_at: b.created_at || null });
   }
   return items;
 }
@@ -165,7 +165,7 @@ function render(state, installedSet = new Set()) {
     const toolsBadge = item.has_tools ? chalk.hex('#F59E0B')(' 🔧') : '';
     const extra = item.type === 'bundle'
       ? item.skillCount
-        ? blue(((installed ? '' : '~') + item.skillCount + ' sk').padEnd(8)) + toolsBadge
+        ? blue(((installed || item.validated ? '' : '~') + item.skillCount + ' sk').padEnd(8)) + toolsBadge
         : item.repo_url
           ? chalk.hex('#3B82F6')('↗ GitHub') + toolsBadge
           : dim(((item.skills?.length || 0) + ' sk').padEnd(8)) + toolsBadge