promptgraph-mcp 2.9.51 → 2.9.53

package/commands/marketplace.js

@@ -42,6 +42,7 @@ export default async function handler(args, bin) {
   const { getCachedCount, setCachedCount, refreshCountsInBackground } = await import('../bundle-counts.js');
   const { SKILLS_STORE_DIR } = await import('../config.js');
   const { globSync } = await import('glob');
+  const { SCRIPT_GLOBS } = await import('../github-import.js');
   const githubDir = path.join(SKILLS_STORE_DIR, 'github');
 
   // For each bundle: if installed on disk — use real file count + detect scripts; otherwise use cache
@@ -51,14 +52,14 @@ export default async function handler(args, bin) {
     const repo  = b.repo_url.split('/')[1];
     const clonedDir = path.join(githubDir, `${owner}-${repo}`);
     if (fs.existsSync(clonedDir) && fs.readdirSync(clonedDir).length > 0) {
-      const realCount = globSync(`${clonedDir}/**/*.md`).length;
-      const hasScripts = globSync(`${clonedDir}/**/*.{py,sh,bash,js,ts,rb}`).length > 0;
+      const realCount = globSync(`${clonedDir}/**/*.md`, { absolute: true }).length;
+      const hasScripts = globSync(SCRIPT_GLOBS.map(p => `${clonedDir}/${p}`), { absolute: true }).length > 0;
       setCachedCount(b.repo_url, realCount);
       return { ...b, skillCount: realCount, has_tools: b.has_tools || hasScripts };
     }
     const cached = getCachedCount(b.repo_url);
     const knownCount = cached ?? b.skill_count ?? null;
-    return knownCount !== null ? { ...b, skillCount: knownCount } : b;
+    return knownCount !== null ? { ...b, skillCount: knownCount, has_tools: b.has_tools } : b;
   });
   refreshCountsInBackground(bundlesWithCounts);
 

package/github-import.js

@@ -14,6 +14,10 @@ const downloadRateLimiter = new RateLimiter({ maxRequests: RATE_LIMIT_REQUESTS *
 
 const SKILL_DIRS = ['skills', 'commands', 'prompts', 'agents', 'skills-store', 'slash-commands', 'custom-commands', 'templates'];
 
+// glob v13 brace-expansion ({py,sh,...}) returns nothing on Windows — use an
+// array of explicit patterns instead so script detection works cross-platform.
+export const SCRIPT_GLOBS = ['**/*.py', '**/*.sh', '**/*.bash', '**/*.js', '**/*.ts', '**/*.rb'];
+
 // ── helpers ───────────────────────────────────────────────────────────────────
 
 const repoStats = new Map()
@@ -201,70 +205,87 @@ export async function validateRepoSkills(ownerRepo) {
 
 const SCRIPT_EXTS_API = new Set(['.py', '.sh', '.bash', '.js', '.ts', '.rb']);
 
-function countValidMd(fileEntries) {
-  return fileEntries.filter(e =>
-    e.type === 'file' && e.name.endsWith('.md') &&
-    !SKIP_RE.test(e.name.replace(/\.md$/i, '').toLowerCase())
-  ).length;
-}
-
-function hasScriptFiles(fileEntries) {
-  return fileEntries.some(e => e.type === 'file' && SCRIPT_EXTS_API.has(path.extname(e.name).toLowerCase()));
-}
-
 // Ask GitHub API which subdir to use (without cloning anything). Exported for validation.
 // Returns { subdir, label, validMdCount, hasScripts } or null (repo not found / no skills).
+//
+// Uses the recursive git-tree API (1 call) and counts .md files RECURSIVELY under each
+// candidate dir. This handles nested layouts like skills/cloud/*.md or skills/<name>/SKILL.md
+// where a skill dir holds category subfolders rather than .md files directly — the old
+// shallow per-dir listing reported "0 skills" for those and blocked publishing.
 export
 async function detectSkillsDirFromAPI(ownerRepo) {
+  let tree;
   try {
-    const json = await httpsGet(`https://api.github.com/repos/${ownerRepo}/contents`);
-    const entries = JSON.parse(json);
-
-    // 1. Known skill dir names (priority order)
-    const dirMap = new Map(entries.filter(e => e.type === 'dir').map(e => [e.name.toLowerCase(), e.name]));
-    for (const d of SKILL_DIRS) {
-      if (dirMap.has(d)) {
-        try {
-          const sub = JSON.parse(await httpsGet(`https://api.github.com/repos/${ownerRepo}/contents/${dirMap.get(d)}`));
-          const validMdCount = countValidMd(sub);
-          if (validMdCount === 0) continue; // dir exists but no valid skills — try next
-          return { subdir: dirMap.get(d), label: d, validMdCount, hasScripts: hasScriptFiles(sub) };
-        } catch {}
-      }
+    tree = JSON.parse(await httpsGet(`https://api.github.com/repos/${ownerRepo}/git/trees/HEAD?recursive=1`));
+  } catch {
+    return null; // repo not found or inaccessible
+  }
+  if (!tree || !Array.isArray(tree.tree)) return null;
+
+  const blobs = tree.tree.filter(f => f.type === 'blob');
+  if (blobs.length === 0) return null;
+
+  // A path is a valid skill .md if the filename isn't meta (readme/license/…) and no
+  // path segment is a skip dir (docs/tests/assets/…).
+  const isValidMd = (p) => {
+    if (!p.endsWith('.md')) return false;
+    if (SKIP_RE.test(path.basename(p, '.md').toLowerCase())) return false;
+    const segs = p.split('/');
+    for (const seg of segs.slice(0, -1)) if (SKIP_DIRS_API.has(seg.toLowerCase())) return false;
+    return true;
+  };
+  const mdBlobs = blobs.filter(f => isValidMd(f.path));
+  if (mdBlobs.length === 0) return null;
+
+  const countUnder  = (prefix) => mdBlobs.filter(f => f.path.startsWith(prefix)).length;
+  const scriptUnder = (prefix) => blobs.some(f => f.path.startsWith(prefix) && SCRIPT_EXTS_API.has(path.extname(f.path).toLowerCase()));
+
+  // Map of top-level dir names (lowercase -> real casing)
+  const topDirs = new Map();
+  for (const f of blobs) {
+    const idx = f.path.indexOf('/');
+    if (idx > 0) { const d = f.path.slice(0, idx); topDirs.set(d.toLowerCase(), d); }
+  }
+
+  // 1. Known skill dir names (priority order) — counted recursively
+  for (const d of SKILL_DIRS) {
+    if (topDirs.has(d)) {
+      const real = topDirs.get(d);
+      const c = countUnder(`${real}/`);
+      if (c > 0) return { subdir: real, label: real, validMdCount: c, hasScripts: scriptUnder(`${real}/`) };
     }
+  }
 
-    // 1.5 Nested skills dirs (e.g. .claude/skills, .claude-plugin/commands)
-    for (const prefix of ['.claude', '.claude-plugin']) {
-      if (dirMap.has(prefix)) {
-        for (const d of SKILL_DIRS) {
-          const nested = `${prefix}/${d}`;
-          try {
-            const sub = JSON.parse(await httpsGet(`https://api.github.com/repos/${ownerRepo}/contents/${nested}`));
-            const validMdCount = countValidMd(sub);
-            if (validMdCount > 0) return { subdir: nested, label: nested, validMdCount, hasScripts: hasScriptFiles(sub) };
-          } catch {}
-        }
+  // 1.5 Nested skill dirs (e.g. .claude/skills, .claude-plugin/commands)
+  for (const prefix of ['.claude', '.claude-plugin']) {
+    if (topDirs.has(prefix)) {
+      const real = topDirs.get(prefix);
+      for (const d of SKILL_DIRS) {
+        const nested = `${real}/${d}`;
+        const c = countUnder(`${nested}/`);
+        if (c > 0) return { subdir: nested, label: nested, validMdCount: c, hasScripts: scriptUnder(`${nested}/`) };
       }
     }
+  }
 
-    // 2. Any subdir with valid .md files — pick the one with most
-    const subdirCandidates = entries.filter(e => e.type === 'dir' && !SKIP_DIRS_API.has(e.name.toLowerCase()));
-    let best = null, bestCount = 0, bestScripts = false;
-    for (const dir of subdirCandidates) {
-      try {
-        const sub = JSON.parse(await httpsGet(`https://api.github.com/repos/${ownerRepo}/contents/${dir.name}`));
-        const mdCount = countValidMd(sub);
-        if (mdCount > bestCount) { best = dir.name; bestCount = mdCount; bestScripts = hasScriptFiles(sub); }
-      } catch {}
-    }
-    if (best) return { subdir: best, label: best, validMdCount: bestCount, hasScripts: bestScripts };
+  // 2. Root-level .md files (skills kept directly at repo root)
+  const rootMd = mdBlobs.filter(f => !f.path.includes('/')).length;
 
-    // 3. Root-level valid .md files
-    const validMdCount = countValidMd(entries);
-    if (validMdCount >= 1) return { subdir: null, label: 'root', validMdCount, hasScripts: hasScriptFiles(entries) };
+  // 3. Best non-skip top-level subdir by recursive .md count
+  let best = null, bestCount = 0;
+  for (const [low, real] of topDirs) {
+    if (SKIP_DIRS_API.has(low)) continue;
+    const c = countUnder(`${real}/`);
+    if (c > bestCount) { bestCount = c; best = real; }
+  }
 
-  } catch {}
-  return null; // repo not found or inaccessible
+  // Prefer root when it holds the skills (and is at least as rich as any subdir)
+  if (rootMd >= 1 && rootMd >= bestCount) {
+    return { subdir: null, label: 'root', validMdCount: rootMd, hasScripts: scriptUnder('') };
+  }
+  if (best) return { subdir: best, label: best, validMdCount: bestCount, hasScripts: scriptUnder(`${best}/`) };
+
+  return null;
 }
 
 // Deep-validate a repo bundle via 1 API call (tree) + raw file fetches (not rate-limited).
@@ -768,26 +789,25 @@ function detectSubdirFromTree(repoRoot) {
 
 // ── light version (git sparse-checkout, no API rate limits) ───────────────────
 
-export async function importFromGitHubLight(repoUrl) {
-  if (!repoUrl) throw new Error('Missing repoUrl');
-
-  const url = repoUrl.startsWith('http') ? repoUrl : `https://github.com/${repoUrl}`;
-  const ownerRepo = url.replace(/^https?:\/\/github\.com\//, '').replace(/\.git$/, '');
-  const repoName = ownerRepo.replace('/', '-');
-  const destBase = path.join(getSkillsStoreDir(), 'github', repoName);
+// Core clone + filter pipeline. Single source of truth for both real installs
+// and offline validation. Materializes the skills subdir into destBase, applies
+// isSkillFile + validateSkill filters, and returns the ground-truth result.
+// NO side effects (no config write, no indexing) — caller decides what to do.
+// Throws 'No valid skills...' if nothing survives filtering.
+export function cloneAndFilterRepo(ownerRepo, destBase, prog = () => {}) {
   const cloneUrl = `https://github.com/${ownerRepo}.git`;
-
   if (fs.existsSync(destBase)) fs.rmSync(destBase, { recursive: true, force: true });
   fs.mkdirSync(destBase, { recursive: true });
 
   const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: '0' };
-  const prog = (msg) => process.stderr.write(`\r\x1b[K  ${msg}`);
+  // core.longpaths=true — required on Windows for repos with deep nested paths
+  // (>260 chars) that otherwise fail checkout with "UNKNOWN: open" / "Checkout failed".
+  const LP = ['-c', 'core.longpaths=true'];
 
   // Step 1: treeless clone — gets file tree instantly, no blob download, no API
   prog(`Cloning ${ownerRepo}...`);
-  const init = spawnSync('git', ['clone', '--depth=1', '--filter=blob:none', '--no-checkout', '--progress', cloneUrl, destBase], { stdio: 'pipe', env: gitEnv, timeout: 120000 });
+  const init = spawnSync('git', [...LP, 'clone', '--depth=1', '--filter=blob:none', '--no-checkout', '--progress', cloneUrl, destBase], { stdio: 'pipe', env: gitEnv, timeout: 120000 });
   if (init.status !== 0) {
-    process.stderr.write('\n');
     fs.rmSync(destBase, { recursive: true, force: true });
     throw new Error(`Failed to clone ${ownerRepo}: ${(init.stderr?.toString() || '').trim().slice(0, 120)}`);
   }
@@ -798,15 +818,15 @@ export async function importFromGitHubLight(repoUrl) {
 
   // Step 3: sparse-checkout skills subdir — .md files + scripts (.py/.sh/.js/.ts/.rb/.bash)
   prog(`Setting up sparse checkout${subdir ? ` (${subdir}/)` : ''}...`);
-  spawnSync('git', ['-C', destBase, 'sparse-checkout', 'init'], { stdio: 'pipe', env: gitEnv });
+  spawnSync('git', [...LP, '-C', destBase, 'sparse-checkout', 'init'], { stdio: 'pipe', env: gitEnv });
   if (subdir) {
-    spawnSync('git', ['-C', destBase, 'sparse-checkout', 'set', '--no-cone',
+    spawnSync('git', [...LP, '-C', destBase, 'sparse-checkout', 'set', '--no-cone',
       `${subdir}/*.md`, `${subdir}/**/*.md`,
       `${subdir}/**/*.py`, `${subdir}/**/*.sh`, `${subdir}/**/*.js`,
       `${subdir}/**/*.ts`, `${subdir}/**/*.rb`, `${subdir}/**/*.bash`,
     ], { stdio: 'pipe', env: gitEnv });
   } else {
-    spawnSync('git', ['-C', destBase, 'sparse-checkout', 'set', '--no-cone',
+    spawnSync('git', [...LP, '-C', destBase, 'sparse-checkout', 'set', '--no-cone',
       '*.md', '**/*.md',
       '**/*.py', '**/*.sh', '**/*.js', '**/*.ts', '**/*.rb', '**/*.bash',
     ], { stdio: 'pipe', env: gitEnv });
@@ -814,26 +834,29 @@ export async function importFromGitHubLight(repoUrl) {
 
   // Step 4: checkout to materialize only the selected files
   prog(`Downloading .md files...`);
-  const co = spawnSync('git', ['-C', destBase, 'checkout'], { stdio: 'pipe', env: gitEnv, timeout: 120000 });
+  const co = spawnSync('git', [...LP, '-C', destBase, 'checkout'], { stdio: 'pipe', env: gitEnv, timeout: 120000 });
   if (co.status !== 0) {
-    process.stderr.write('\n');
     fs.rmSync(destBase, { recursive: true, force: true });
     throw new Error(`Checkout failed for ${ownerRepo}`);
   }
   // Force blob materialization (needed for partial clones on Windows)
-  spawnSync('git', ['-C', destBase, 'checkout', 'HEAD', '--', '.'], { stdio: 'pipe', env: gitEnv, timeout: 120000 });
-  process.stderr.write('\n');
+  spawnSync('git', [...LP, '-C', destBase, 'checkout', 'HEAD', '--', '.'], { stdio: 'pipe', env: gitEnv, timeout: 120000 });
 
   // Make scripts executable on unix
   if (process.platform !== 'win32') {
     try {
-      const scripts = globSync(`${destBase}/**/*.{py,sh,bash,js,ts,rb}`, { absolute: true });
+      const scripts = globSync(SCRIPT_GLOBS.map(p => `${destBase}/${p}`), { absolute: true });
       for (const s of scripts) { try { fs.chmodSync(s, 0o755); } catch {} }
     } catch {}
   }
 
+  // hasScripts = real scripts on disk in the materialized subdir (ground truth)
+  const hasScripts = globSync(SCRIPT_GLOBS.map(p => `${destBase}/${p}`), { absolute: true }).length > 0;
+
   // Step 5: filter out non-skill files locally
-  const allMd = globSync(`${destBase}/**/*.md`);
+  // absolute:true — otherwise glob returns cwd-relative paths; when destBase is not
+  // under cwd those contain ".." and validateSkill flags every file as path-traversal.
+  const allMd = globSync(`${destBase}/**/*.md`, { absolute: true });
   prog(`Filtering ${allMd.length} files...`);
   let removed = 0;
   for (const fp of allMd) {
@@ -841,7 +864,7 @@ export async function importFromGitHubLight(repoUrl) {
   }
   if (removed > 0) removeEmptyDirs(destBase);
 
-  const remaining = globSync(`${destBase}/**/*.md`);
+  const remaining = globSync(`${destBase}/**/*.md`, { absolute: true });
   prog(`Validating ${remaining.length} skill files...`);
   let removedV = 0;
   for (const fp of remaining) {
@@ -850,15 +873,29 @@ export async function importFromGitHubLight(repoUrl) {
   }
   if (removedV > 0) removeEmptyDirs(destBase);
 
-  process.stderr.write('\n');
-
-  const realCount = globSync(`${destBase}/**/*.md`).length;
+  const realCount = globSync(`${destBase}/**/*.md`, { absolute: true }).length;
 
   if (realCount < 1) {
     fs.rmSync(destBase, { recursive: true, force: true });
     throw new Error('No valid skills in repo — all files were filtered out');
   }
 
+  return { realCount, hasScripts, subdir };
+}
+
+export async function importFromGitHubLight(repoUrl) {
+  if (!repoUrl) throw new Error('Missing repoUrl');
+
+  const url = repoUrl.startsWith('http') ? repoUrl : `https://github.com/${repoUrl}`;
+  const ownerRepo = url.replace(/^https?:\/\/github\.com\//, '').replace(/\.git$/, '');
+  const repoName = ownerRepo.replace('/', '-');
+  const destBase = path.join(getSkillsStoreDir(), 'github', repoName);
+
+  const prog = (msg) => process.stderr.write(`\r\x1b[K  ${msg}`);
+
+  const { realCount, subdir } = cloneAndFilterRepo(ownerRepo, destBase, prog);
+  process.stderr.write('\n');
+
   // Update both caches with the real post-filter count
   try {
     const { setCachedCount } = await import('./bundle-counts.js');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "promptgraph-mcp",
-  "version": "2.9.51",
+  "version": "2.9.53",
   "files": [
     "*.js",
     "commands/",