reskill 1.17.0 → 1.18.0

package/dist/cli/commands/find.d.ts

@@ -15,6 +15,7 @@ interface FindOptions {
     registry?: string;
     limit?: string;
     json?: boolean;
+    token?: string;
 }
 /**
  * Execute the find command

package/dist/cli/commands/find.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"find.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/find.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAapC,UAAU,WAAW;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AA0ED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAgCnF;AAMD,eAAO,MAAM,WAAW,SAUH,CAAC;AAEtB,eAAe,WAAW,CAAC"}
+{"version":3,"file":"find.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/find.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,UAAU,WAAW;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA0ED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAwCnF;AAMD,eAAO,MAAM,WAAW,SAWH,CAAC;AAEtB,eAAe,WAAW,CAAC"}

package/dist/cli/commands/publish.d.ts

@@ -27,6 +27,16 @@ export declare function buildPublishSkillName(name: string, registry: string, _u
  * @internal Exported for testing
  */
 export declare function isBlockedPublicRegistry(registryUrl: string): boolean;
+/**
+ * Check authentication
+ *
+ * Token resolution: --token CLI flag > RESKILL_TOKEN env > ~/.reskillrc
+ *
+ * @internal Exported for testing
+ */
+export declare function checkAuth(registry: string, dryRun: boolean, cliToken?: string): {
+    token: string;
+} | null;
 /**
  * Parse user's confirmation answer
  *

package/dist/cli/commands/publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/publish.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsDpC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAcR;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAYpE;AA2ND;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAI1D;AAoBD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAyBnE;AAkUD,eAAO,MAAM,cAAc,SAaH,CAAC;AAEzB,eAAe,cAAc,CAAC"}
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/publish.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuDpC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAcR;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAYpE;AAqBD;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAsB1B;AAkLD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAI1D;AAoBD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAyBnE;AA0TD,eAAO,MAAM,cAAc,SAcH,CAAC;AAEzB,eAAe,cAAc,CAAC"}

package/dist/cli/index.js

@@ -6579,8 +6579,15 @@ class AuthManager {
         return;
     }
     const registry = resolveRegistryForSearch(options.registry);
+    // Resolve auth token: --token flag > RESKILL_TOKEN env > ~/.reskillrc
+    let token = options.token;
+    if (!token) {
+        const authManager = new AuthManager();
+        token = authManager.getToken(registry) ?? void 0;
+    }
     const client = new RegistryClient({
-        registry
+        registry,
+        token
     });
     try {
         const { items, total } = await client.search(query, {
@@ -6600,7 +6607,7 @@ class AuthManager {
 // ============================================================================
 // Command Definition
 // ============================================================================
-const findCommand = new __WEBPACK_EXTERNAL_MODULE_commander__.Command('find').alias('search').description('Search for skills in the registry').argument('<query>', 'Search query').option('-r, --registry <url>', 'Registry URL (or set RESKILL_REGISTRY env var, or defaults.publishRegistry in skills.json)').option('-l, --limit <n>', 'Maximum number of results', '10').option('-j, --json', 'Output as JSON').action(findAction);
+const findCommand = new __WEBPACK_EXTERNAL_MODULE_commander__.Command('find').alias('search').description('Search for skills in the registry').argument('<query>', 'Search query').option('-r, --registry <url>', 'Registry URL (or set RESKILL_REGISTRY env var, or defaults.publishRegistry in skills.json)').option('-l, --limit <n>', 'Maximum number of results', '10').option('-j, --json', 'Output as JSON').option('-t, --token <token>', 'Auth token for registry API requests (for CI/CD)').action(findAction);
 /**
  * Group path utilities — normalization, slug generation, and validation.
  *
@@ -8232,6 +8239,7 @@ const SNIPPET_MAX_LENGTH = 120;
         }
     },
     // Rule 3: Content Obfuscation (high) — scans ALL content including safe zones
+    //   Zero-width chars and base64 are suspicious everywhere (even inside code blocks).
     {
         id: 'obfuscation',
         level: 'high',
@@ -8252,6 +8260,18 @@ const SNIPPET_MAX_LENGTH = 120;
                 line: i + 1,
                 snippet: 'Suspicious base64-encoded block detected'
             });
+            return matches;
+        }
+    },
+    // Rule 3b: Large HTML Comments (high) — respects safe zones (code blocks, etc.)
+    //   HTML comments inside fenced code blocks are normal code examples, not obfuscation.
+    {
+        id: 'obfuscation',
+        level: 'high',
+        message: 'Detected content obfuscation',
+        skipSafeZones: true,
+        check: (content)=>{
+            const matches = [];
             // Large HTML comments (>200 chars of content)
             const commentRegex = /<!--([\s\S]{200,}?)-->/g;
             let match;
@@ -9093,7 +9113,15 @@ class SkillValidator {
 }
 /**
  * Check authentication
- */ function checkAuth(registry, dryRun) {
+ *
+ * Token resolution: --token CLI flag > RESKILL_TOKEN env > ~/.reskillrc
+ *
+ * @internal Exported for testing
+ */ function checkAuth(registry, dryRun, cliToken) {
+    // --token flag takes highest priority
+    if (cliToken) return {
+        token: cliToken
+    };
     const authManager = new AuthManager();
     const token = authManager.getToken(registry);
     if (!token) {
@@ -9104,7 +9132,7 @@ class SkillValidator {
         logger_logger.error('Authentication required');
         logger_logger.newline();
         logger_logger.log('You must be logged in to publish skills.');
-        logger_logger.log("Run 'reskill login' to authenticate.");
+        logger_logger.log("Run 'reskill login' to authenticate, or pass --token <token>.");
         process.exit(1);
     }
     return {
@@ -9363,7 +9391,7 @@ async function publishAction(skillPath, options) {
     try {
         // 1. Check authentication (skip for dry-run)
         // Note: checkAuth exits the process if not authenticated (unless dry-run)
-        checkAuth(registry, options.dryRun || false);
+        const authResult = checkAuth(registry, options.dryRun || false, options.token);
         // 2. Load skill
         const skill = validator.loadSkill(absolutePath);
         // 2.5. Check version - prompt if missing and not in --yes/--dry-run mode
@@ -9463,16 +9491,8 @@ async function publishAction(skillPath, options) {
                 return;
             }
         }
-        // 10. Get auth token
-        const authManager = new AuthManager();
-        const token = authManager.getToken(registry);
-        if (!token) {
-            logger_logger.error('Authentication required');
-            logger_logger.newline();
-            logger_logger.log('You must be logged in to publish skills.');
-            logger_logger.log("Run 'reskill login' to authenticate.");
-            process.exit(1);
-        }
+        // 10. Get auth token (already resolved by checkAuth in step 1)
+        const token = authResult?.token;
         // 11. Actually publish
         logger_logger.newline();
         logger_logger.log(`Publishing to ${registry}...`);
@@ -9528,7 +9548,7 @@ async function publishAction(skillPath, options) {
 // ============================================================================
 // Command Definition
 // ============================================================================
-const publishCommand = new __WEBPACK_EXTERNAL_MODULE_commander__.Command('publish').alias('pub').description('Publish a skill to the registry').argument('[path]', 'Path to skill directory', '.').option('-r, --registry <url>', 'Registry URL (or set RESKILL_REGISTRY env var, or defaults.publishRegistry in skills.json)').option('-t, --tag <tag>', 'Git tag to publish').option('--access <level>', 'Access level: public or restricted', 'public').option('-n, --dry-run', 'Validate without publishing').option('-y, --yes', 'Skip confirmation prompts').option('-g, --group <path>', 'Publish skill into a group (e.g., "kanyun/frontend")').action(publishAction);
+const publishCommand = new __WEBPACK_EXTERNAL_MODULE_commander__.Command('publish').alias('pub').description('Publish a skill to the registry').argument('[path]', 'Path to skill directory', '.').option('-r, --registry <url>', 'Registry URL (or set RESKILL_REGISTRY env var, or defaults.publishRegistry in skills.json)').option('-t, --tag <tag>', 'Git tag to publish').option('--access <level>', 'Access level: public or restricted', 'public').option('-n, --dry-run', 'Validate without publishing').option('-y, --yes', 'Skip confirmation prompts').option('-g, --group <path>', 'Publish skill into a group (e.g., "kanyun/frontend")').option('--token <token>', 'Auth token for registry API requests (for CI/CD)').action(publishAction);
 /**
  * uninstall command - Uninstall one or more skills
  */ const uninstallCommand = new __WEBPACK_EXTERNAL_MODULE_commander__.Command('uninstall').alias('un').alias('remove').alias('rm').description('Uninstall one or more skills').argument('<skills...>', 'Skill names to uninstall').option('-g, --global', 'Uninstall from global installation (~/.claude/skills)').option('-y, --yes', 'Skip confirmation prompts').action(async (skillNames, options)=>{

package/dist/core/content-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content-scanner.d.ts","sourceRoot":"","sources":["../../src/core/content-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAElD,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB;IACjB,KAAK,EAAE,SAAS,CAAC;IACjB,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;IAChB,oCAAoC;IACpC,QAAQ,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,iBAAiB;IACjB,KAAK,EAAE,SAAS,CAAC;IACjB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,aAAa,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,aAAa,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,cAAc;IAC7B,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtC,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,iCAAiC;IACjC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC1B;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA6ErD;AAmDD,+BAA+B;AAC/B,eAAO,MAAM,aAAa,EAAE,SAAS,QAAQ,EAoN5C,CAAC;AA+BF;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAAa;gBAEd,OAAO,CAAC,EAAE,cAAc;IAIpC;;;OAGG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU;IAoCjC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU;CAOvC;AAMD;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;gBAErB,QAAQ,EAAE,WAAW,EAAE;CAQpC"}
+{"version":3,"file":"content-scanner.d.ts","sourceRoot":"","sources":["../../src/core/content-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAElD,MAAM,WAAW,WAAW;IAC1B,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB;IACjB,KAAK,EAAE,SAAS,CAAC;IACjB,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;IAChB,oCAAoC;IACpC,QAAQ,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,iBAAiB;IACjB,KAAK,EAAE,SAAS,CAAC;IACjB,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,aAAa,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,aAAa,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,cAAc;IAC7B,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtC,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,iCAAiC;IACjC,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC1B;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA6ErD;AAmDD,+BAA+B;AAC/B,eAAO,MAAM,aAAa,EAAE,SAAS,QAAQ,EAmO5C,CAAC;AA+BF;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,KAAK,CAAa;gBAEd,OAAO,CAAC,EAAE,cAAc;IAIpC;;;OAGG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU;IAoCjC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU;CAOvC;AAMD;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;gBAErB,QAAQ,EAAE,WAAW,EAAE;CAQpC"}

package/dist/index.js

@@ -200,6 +200,7 @@ const SNIPPET_MAX_LENGTH = 120;
         }
     },
     // Rule 3: Content Obfuscation (high) — scans ALL content including safe zones
+    //   Zero-width chars and base64 are suspicious everywhere (even inside code blocks).
     {
         id: 'obfuscation',
         level: 'high',
@@ -220,6 +221,18 @@ const SNIPPET_MAX_LENGTH = 120;
                 line: i + 1,
                 snippet: 'Suspicious base64-encoded block detected'
             });
+            return matches;
+        }
+    },
+    // Rule 3b: Large HTML Comments (high) — respects safe zones (code blocks, etc.)
+    //   HTML comments inside fenced code blocks are normal code examples, not obfuscation.
+    {
+        id: 'obfuscation',
+        level: 'high',
+        message: 'Detected content obfuscation',
+        skipSafeZones: true,
+        check: (content)=>{
+            const matches = [];
             // Large HTML comments (>200 chars of content)
             const commentRegex = /<!--([\s\S]{200,}?)-->/g;
             let match;

package/dist/scanner.js

@@ -167,6 +167,7 @@ const SNIPPET_MAX_LENGTH = 120;
         }
     },
     // Rule 3: Content Obfuscation (high) — scans ALL content including safe zones
+    //   Zero-width chars and base64 are suspicious everywhere (even inside code blocks).
     {
         id: 'obfuscation',
         level: 'high',
@@ -187,6 +188,18 @@ const SNIPPET_MAX_LENGTH = 120;
                 line: i + 1,
                 snippet: 'Suspicious base64-encoded block detected'
             });
+            return matches;
+        }
+    },
+    // Rule 3b: Large HTML Comments (high) — respects safe zones (code blocks, etc.)
+    //   HTML comments inside fenced code blocks are normal code examples, not obfuscation.
+    {
+        id: 'obfuscation',
+        level: 'high',
+        message: 'Detected content obfuscation',
+        skipSafeZones: true,
+        check: (content)=>{
+            const matches = [];
             // Large HTML comments (>200 chars of content)
             const commentRegex = /<!--([\s\S]{200,}?)-->/g;
             let match;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "reskill",
-  "version": "1.17.0",
+  "version": "1.18.0",
   "description": "AI Skills Package Manager - Git-based skills management for AI agents",
   "type": "module",
   "main": "./dist/index.js",