sanook-cli 0.5.2 → 0.5.7

package/dist/providers/codex.js

@@ -5,8 +5,18 @@ import { join } from 'node:path';
 export function codexHome() {
     return process.env.CODEX_HOME?.trim() || join(homedir(), '.codex');
 }
+async function readCodexLoggedIn() {
+    try {
+        const auth = JSON.parse(await readFile(join(codexHome(), 'auth.json'), 'utf8'));
+        return auth?.auth_mode === 'chatgpt' || Boolean(auth?.tokens?.access_token);
+    }
+    catch {
+        return false;
+    }
+}
 /** เช็กว่า codex CLI ติดตั้ง + login ChatGPT แล้ว */
 export async function detectCodex() {
+    const loggedIn = await readCodexLoggedIn();
     const hasBinary = await new Promise((resolve) => {
         const p = spawn('codex', ['--version'], { shell: process.platform === 'win32' });
         // timeout: binary ค้าง (shim รอ stdin / Gatekeeper stall ตอนรันครั้งแรกบน macOS) → ไม่ให้ wizard ตัน
@@ -24,16 +34,18 @@ export async function detectCodex() {
         });
     });
     if (!hasBinary) {
-        return { installed: false, loggedIn: false, reason: 'ไม่พบ codex CLI — ติดตั้ง: npm i -g @openai/codex' };
-    }
-    try {
-        const auth = JSON.parse(await readFile(join(codexHome(), 'auth.json'), 'utf8'));
-        const loggedIn = auth?.auth_mode === 'chatgpt' || Boolean(auth?.tokens?.access_token);
-        return { installed: true, loggedIn, reason: loggedIn ? undefined : 'ยังไม่ได้ login — รัน: codex login' };
+        return {
+            installed: false,
+            loggedIn,
+            reason: loggedIn
+                ? 'login แล้ว แต่ยังไม่มี codex CLI — ติดตั้ง: npm i -g @openai/codex'
+                : 'ไม่พบ codex CLI — ติดตั้ง: npm i -g @openai/codex',
+        };
     }
-    catch {
-        return { installed: true, loggedIn: false, reason: 'ยังไม่ได้ login — รัน: codex login' };
+    if (loggedIn) {
+        return { installed: true, loggedIn: true, reason: undefined };
     }
+    return { installed: true, loggedIn: false, reason: 'ยังไม่ได้ login — รัน: codex login' };
 }
 /**
  * รัน `codex exec` แบบ non-interactive — ส่ง prompt ทาง stdin, parse JSONL events

package/dist/providers/keys.js

@@ -36,3 +36,24 @@ export function assertDirectApiKey(policy, key) {
 export function redactKey(s) {
     return s.replace(/\b(AKIA[0-9A-Z]{16}|sk-[A-Za-z0-9_-]{6,}|AIza[A-Za-z0-9_-]{10,}|xai-[A-Za-z0-9]{10,}|gsk_[A-Za-z0-9]{10,}|[A-Za-z0-9_-]{24,})\b/g, (m) => (m.length > 8 ? `${m.slice(0, 4)}…${m.slice(-2)}` : '…'));
 }
+export function redactUnknown(value) {
+    const visiting = new WeakSet();
+    const visit = (current) => {
+        if (typeof current === 'string')
+            return redactKey(current);
+        if (!current || typeof current !== 'object')
+            return current;
+        if (visiting.has(current))
+            return '[Circular]';
+        visiting.add(current);
+        try {
+            if (Array.isArray(current))
+                return current.map(visit);
+            return Object.fromEntries(Object.entries(current).map(([k, v]) => [redactKey(k), visit(v)]));
+        }
+        finally {
+            visiting.delete(current);
+        }
+    };
+    return visit(value);
+}

package/dist/providers/models.js

@@ -22,7 +22,7 @@ export async function listRemoteModels(cfg, key, timeoutMs = 6000) {
                 .map((m) => (m.name ?? '').replace(/^models\//, ''))
                 .filter(Boolean);
         }
-        const base = process.env[`${cfg.id.toUpperCase()}_BASE_URL`] ?? cfg.baseURL;
+        const base = process.env[`${cfg.id.toUpperCase()}_BASE_URL`]?.trim() || cfg.baseURL?.trim();
         if (!base)
             return []; // ไม่มี baseURL = ดึงไม่ได้
         const headers = cfg.id === 'anthropic'

package/dist/providers/registry.js

@@ -134,7 +134,17 @@ export const PROVIDERS = {
         requiresKey: false,
         localPlaceholderKey: 'codex',
         keyFormat: null,
-        models: { default: 'gpt-5-codex', codex: 'gpt-5-codex' },
+        models: {
+            default: 'gpt-5.5',
+            codex: 'gpt-5.5',
+            '5.5': 'gpt-5.5',
+            '5.4': 'gpt-5.4',
+            '5.4-mini': 'gpt-5.4-mini',
+            '5.3-codex': 'gpt-5.3-codex',
+            '5.2-codex': 'gpt-5.2-codex',
+            '5-codex': 'gpt-5-codex',
+            spark: 'gpt-5.3-codex-spark',
+        },
         create: () => {
             throw new Error('codex เป็น delegate provider — ใช้ผ่าน codex subprocess ไม่ใช่ Vercel AI SDK');
         },

package/dist/search/cli.js

@@ -19,7 +19,9 @@ function inlineSourceValue(value) {
 export function parseSearchArgs(args) {
     const queryParts = [];
     let mode = 'auto';
+    let modeSet = false;
     let limit = 8;
+    let limitSet = false;
     let sources;
     for (let i = 0; i < args.length; i++) {
         const a = args[i];
@@ -36,7 +38,10 @@ export function parseSearchArgs(args) {
                 return { ok: false, message: `--mode ต้องระบุค่าเป็น ${SEARCH_MODES.join('|')}` };
             if (!isSearchMode(v))
                 return { ok: false, message: `--mode ต้องเป็น ${SEARCH_MODES.join('|')}` };
+            if (modeSet)
+                return { ok: false, message: 'ใช้ --mode เพียงครั้งเดียว' };
             mode = v;
+            modeSet = true;
         }
         else if (a === '--limit' || a.startsWith('--limit=')) {
             const next = a === '--limit' ? takeValue(args, i) : undefined;
@@ -48,7 +53,10 @@ export function parseSearchArgs(args) {
             const n = parsePositiveInteger(raw);
             if (n === undefined)
                 return { ok: false, message: '--limit ต้องเป็น integer บวก เช่น 8' };
+            if (limitSet)
+                return { ok: false, message: 'ใช้ --limit เพียงครั้งเดียว' };
             limit = n;
+            limitSet = true;
         }
         else if (a === '--source' || a === '--sources' || a.startsWith('--source=') || a.startsWith('--sources=')) {
             const next = a === '--source' || a === '--sources' ? takeValue(args, i) : undefined;
@@ -62,7 +70,7 @@ export function parseSearchArgs(args) {
             }
             if (bad.length)
                 return { ok: false, message: `--source ต้องเป็น ${SEARCH_SOURCES.join(',')} (คั่นหลายค่าได้ด้วย comma)` };
-            sources = [...new Set(requested)];
+            sources = [...new Set([...(sources ?? []), ...requested])];
         }
         else {
             queryParts.push(a);

package/dist/search/embedding-config.js

@@ -0,0 +1,22 @@
+import { readFile } from 'node:fs/promises';
+import { appHomePath } from '../brand.js';
+const EMBEDDING_MODEL_ENV = 'SANOOK_EMBEDDING_MODEL';
+export function cleanEmbeddingModelSpec(v) {
+    if (typeof v !== 'string')
+        return undefined;
+    const clean = v.trim();
+    return clean ? clean : undefined;
+}
+/** read an optional embeddingModel spec from ~/.sanook/config.json. */
+export async function configEmbeddingModel() {
+    try {
+        const cfg = JSON.parse(await readFile(appHomePath('config.json'), 'utf8'));
+        return cleanEmbeddingModelSpec(cfg.embeddingModel);
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function embeddingModelSpec(override) {
+    return cleanEmbeddingModelSpec(override) ?? cleanEmbeddingModelSpec(process.env[EMBEDDING_MODEL_ENV]) ?? (await configEmbeddingModel());
+}

package/dist/search/engine.js

@@ -14,11 +14,10 @@
 // lazily, and on ANY embedding error degrades to BM25 with a `degraded` flag —
 // search must never throw at the floor.
 // ============================================================================
-import { readFile } from 'node:fs/promises';
-import { appHomePath } from '../brand.js';
 import { bm25Search, termList } from './index-core.js';
 import { rrfFuse } from './fuse.js';
 import { cosineTopK, embedQuery, getEmbedder, loadVectors, vectorsMtimeMs, } from './embed-store.js';
+import { embeddingModelSpec } from './embedding-config.js';
 import { indexMtimeMs, loadIndex } from './store.js';
 const CAND = 60; // candidate pool depth per leg before fusion/limit
 const SNIPPET_WIDTH = 64;
@@ -138,16 +137,6 @@ async function cachedVectors() {
     }
     return vectorCache.vectors;
 }
-/** read an optional embeddingModel spec from ~/.sanook/config.json. */
-async function configEmbeddingModel() {
-    try {
-        const cfg = JSON.parse(await readFile(appHomePath('config.json'), 'utf8'));
-        return cfg.embeddingModel;
-    }
-    catch {
-        return undefined;
-    }
-}
 /** drop in-process caches (tests + after a reindex in the same process). */
 export function resetSearchCaches() {
     indexCache = null;
@@ -165,7 +154,7 @@ export async function search(query, opts = {}) {
     const mode = opts.mode ?? 'auto';
     if (mode === 'fts')
         return rankSearch(index, query, opts);
-    const spec = opts.embeddingModel ?? process.env.SANOOK_EMBEDDING_MODEL ?? (await configEmbeddingModel());
+    const spec = await embeddingModelSpec(opts.embeddingModel);
     const embedder = getEmbedder(spec);
     if (!embedder) {
         const res = rankSearch(index, query, opts);

package/dist/search/indexer.js

@@ -24,6 +24,7 @@ import { loadSkills } from '../skills.js';
 import { activeFacts, effImportance, loadStore } from '../memory-store.js';
 import { chunkMarkdown } from './chunk.js';
 import { addDoc, removeDoc, removeSource } from './index-core.js';
+import { embeddingModelSpec } from './embedding-config.js';
 import { loadIndex, saveIndex } from './store.js';
 import { buildVectorIndex, embedTexts, getEmbedder, invalidateVectors, saveVectors } from './embed-store.js';
 /** strip a .md path to a human title fallback when a chunk has no heading. */
@@ -38,6 +39,14 @@ export async function indexVaultFiles(index, manifest, fs) {
     const next = {};
     const diff = { added: 0, updated: 0, removed: 0, skipped: 0 };
     const paths = await fs.listMarkdown();
+    // Guard against a momentarily-unreadable vault (unmounted drive / perms blip / wrong cwd): walk()
+    // swallows readdir errors and returns [], which would otherwise evict the ENTIRE persisted index
+    // via the deletion sweep below. If a non-empty manifest just lost >50% of its files, treat it as a
+    // transient read failure and keep the existing index+manifest untouched (recovers on the next pass).
+    const manifestSize = Object.keys(manifest).length;
+    if (manifestSize > 0 && paths.length < Math.ceil(manifestSize * 0.5)) {
+        return { manifest, diff: { added: 0, updated: 0, removed: 0, skipped: manifestSize } };
+    }
     const seenExisting = new Set();
     for (const rel of paths) {
         const fp = await fs.fingerprint(rel);
@@ -192,15 +201,6 @@ export function nodeVaultFS(root) {
     };
 }
 const SESSIONS_DIR = appHomePath('sessions');
-async function configEmbeddingModel() {
-    try {
-        const cfg = JSON.parse(await readFile(appHomePath('config.json'), 'utf8'));
-        return cfg.embeddingModel;
-    }
-    catch {
-        return undefined;
-    }
-}
 /** load first-user-message of the most recent sessions (bounded) for the session corpus. */
 export async function loadRecentSessions(limit = 60) {
     const out = [];
@@ -263,7 +263,7 @@ export async function reindex(now = Date.now()) {
     })));
     await saveIndex(index, nextManifest);
     let vectors = 0;
-    const embedder = getEmbedder(process.env.SANOOK_EMBEDDING_MODEL ?? (await configEmbeddingModel()));
+    const embedder = getEmbedder(await embeddingModelSpec());
     if (!embedder) {
         await invalidateVectors().catch(() => { });
     }

package/dist/session-brain.js

@@ -0,0 +1,103 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { BRAND, persistenceEnabled } from './brand.js';
+import { createBrainNote } from './brain-new.js';
+import { getBrainPath } from './memory.js';
+import { PROVIDERS, parseSpec } from './providers/registry.js';
+import { makeSummarizer } from './summarize.js';
+import { distilledFactsFromMessages } from './session-distill.js';
+import { saveSession } from './session.js';
+function transcriptFromTurns(turns) {
+    return turns
+        .filter((t) => t.role === 'user' || t.role === 'assistant')
+        .map((t) => `${t.role === 'user' ? 'User' : 'Assistant'}: ${t.text.trim()}`)
+        .filter((line) => line.length > 8)
+        .join('\n\n');
+}
+function sessionTitleFromHistory(history) {
+    const firstUser = history.find((t) => t.role === 'user')?.text.trim();
+    if (!firstUser)
+        return 'repl session';
+    const cleaned = firstUser.replace(/^\/\w+\s*/, '').trim();
+    return cleaned.split(/\s+/).slice(0, 8).join(' ').slice(0, 72) || 'repl session';
+}
+function injectSessionSummary(template, summary, facts) {
+    const summaryBlock = [summary.trim(), facts.length ? `\n### Key facts\n${facts.map((f) => `- ${f}`).join('\n')}` : '']
+        .filter(Boolean)
+        .join('\n');
+    if (/^## Summary\s*$/m.test(template)) {
+        return template.replace(/^## Summary\s*$/m, `## Summary\n\n${summaryBlock}`);
+    }
+    return `${template.trimEnd()}\n\n## Summary\n\n${summaryBlock}\n`;
+}
+async function summarizeSession(model, transcript, messages) {
+    const provider = parseSpec(model).provider;
+    if (PROVIDERS[provider]?.kind !== 'delegate' && transcript.trim().length > 40) {
+        try {
+            const text = await makeSummarizer(model)(transcript);
+            if (text.trim())
+                return text.trim();
+        }
+        catch {
+            // fall through to heuristic distill
+        }
+    }
+    const facts = distilledFactsFromMessages(messages);
+    if (facts.length)
+        return facts.map((f) => `- ${f}`).join('\n');
+    const lines = transcript.split('\n\n').slice(-6);
+    return lines.length ? lines.join('\n\n') : 'Session ended with no durable transcript.';
+}
+/** Persist REPL session + write a Sessions/ note in the configured second-brain vault. */
+export async function finalizeReplSession(options) {
+    const hasConversation = options.messages.length > 0 || options.history.some((t) => t.role === 'user' || t.role === 'assistant');
+    if (!hasConversation || !persistenceEnabled()) {
+        return { sessionSaved: false };
+    }
+    const now = new Date().toISOString();
+    const session = {
+        id: options.sessionId,
+        title: sessionTitleFromHistory(options.history),
+        created: options.sessionCreated,
+        updated: now,
+        model: options.model,
+        cwd: options.cwd,
+        messages: options.messages,
+    };
+    await saveSession(session);
+    const brainPath = await getBrainPath();
+    if (!brainPath)
+        return { sessionSaved: true };
+    const transcript = transcriptFromTurns(options.history);
+    const summary = await summarizeSession(options.model, transcript, options.messages);
+    const title = sessionTitleFromHistory(options.history);
+    const slugSuffix = options.sessionId.slice(-6);
+    const today = now.slice(0, 10);
+    const output = `Sessions/${today}-${slugSuffix}-session.md`;
+    const report = await createBrainNote({
+        brainPath,
+        type: 'session',
+        title,
+        output,
+        force: true,
+        today,
+    });
+    if (!report.ok || !report.path)
+        return { sessionSaved: true };
+    const facts = distilledFactsFromMessages(options.messages);
+    const raw = await readFile(report.path, 'utf8');
+    const next = injectSessionSummary(raw, summary, facts.slice(0, 8));
+    await writeFile(report.path, next, 'utf8');
+    return {
+        sessionSaved: true,
+        brainNoteRel: report.relPath,
+        brainNotePath: report.path,
+    };
+}
+export function formatFinalizeMessage(result) {
+    if (!result.sessionSaved)
+        return undefined;
+    if (result.brainNoteRel) {
+        return `${BRAND.cliName}: session saved · second-brain → [[${result.brainNoteRel.replace(/\.md$/i, '')}]]`;
+    }
+    return `${BRAND.cliName}: session saved`;
+}

package/dist/session-distill.js

@@ -0,0 +1,84 @@
+// Session knowledge distiller — extracts DURABLE facts (decisions, gotchas, preferences,
+// constraints) from a finished session transcript so they can be folded into the memory store
+// WITHOUT the model voluntarily calling `remember`. Pure + deterministic (heuristic): the offline,
+// zero-cost fallback. An LLM-based extractor can layer on top when a model is available.
+// Signal patterns — a sentence is a candidate only if it matches one (keeps precision up).
+const SIGNALS = [
+    { kind: 'decision', re: /\b(decided|we['’]?ll use|we will use|we use|going with|chose|switch(?:ed|ing)? to|standardiz(?:e|ed|ing) on|settled on|agreed to)\b/i },
+    { kind: 'preference', re: /\b(prefer(?:s|red)?|convention(?: is|:)|by convention|coding style|likes? to|always (?:use|run|prefer|name)|we name)\b/i },
+    { kind: 'constraint', re: /\b(must not|must|never|do ?n['’]?t|don['’]t|required to|is required|only (?:use|run|allow)|forbidden|not allowed|has to)\b/i },
+    { kind: 'gotcha', re: /\b(gotcha|caveat|watch out|the (?:bug|issue|problem|error) (?:was|is)|turned out|root cause|fix(?:ed)? (?:was|by|it by)|fails? (?:if|when|because)|breaks? (?:if|when)|broke because|because the|note that|important:|heads up)\b/i },
+];
+// Strong "X not Y" / "X instead of Y" decision signal (e.g. "pnpm not npm", "tabs over spaces").
+const X_NOT_Y = /\b[\w.@/+-]{2,}\s+(?:not|instead of|over|rather than)\s+[\w.@/+-]{2,}\b/i;
+const MAX_CANDIDATES = 12;
+const MIN_WORDS = 4;
+const MAX_WORDS = 45;
+function looksLikeCodeOrLog(s) {
+    if (/^\s*[$#>]/.test(s))
+        return true; // shell prompt / diff marker
+    if (/[{};=]\s*$/.test(s) && /[(){}\[\]=;]/.test(s))
+        return true; // code-ish line
+    if (/\b(at |Error:|Traceback|stack trace|node_modules\/)/.test(s) && /:\d+/.test(s))
+        return true; // stack trace
+    const symbolRatio = (s.replace(/[\w\s]/g, '').length || 0) / Math.max(1, s.length);
+    return symbolRatio > 0.3; // mostly punctuation/symbols
+}
+function splitSentences(text) {
+    return text
+        .split(/(?<=[.!?])\s+|\n+/)
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+function normalize(s) {
+    return s.replace(/\s+/g, ' ').replace(/^[-*•\d.)\s]+/, '').trim();
+}
+/**
+ * Extract durable-fact candidates from a transcript. Skips questions, chit-chat, code/log lines,
+ * and too-short/too-long sentences; requires a decision/gotcha/preference/constraint signal.
+ */
+export function distillSession(messages) {
+    const out = [];
+    const seen = new Set();
+    for (const msg of messages) {
+        if (msg.role !== 'user' && msg.role !== 'assistant')
+            continue;
+        for (const raw of splitSentences(msg.text)) {
+            const s = normalize(raw);
+            const words = s.split(/\s+/).filter(Boolean);
+            if (words.length < MIN_WORDS || words.length > MAX_WORDS)
+                continue;
+            if (s.endsWith('?'))
+                continue; // questions aren't durable facts
+            if (looksLikeCodeOrLog(s))
+                continue;
+            const signal = SIGNALS.find((sig) => sig.re.test(s));
+            const kind = signal?.kind ?? (X_NOT_Y.test(s) ? 'decision' : undefined);
+            if (!kind)
+                continue;
+            const key = s.toLowerCase().replace(/[^a-z0-9 ]/g, '').trim();
+            if (!key || seen.has(key))
+                continue;
+            seen.add(key);
+            out.push({ text: s, kind });
+            if (out.length >= MAX_CANDIDATES)
+                return out;
+        }
+    }
+    return out;
+}
+/** flatten an AI-SDK ModelMessage content (string | parts[]) to its plain text. */
+function messageText(content) {
+    if (typeof content === 'string')
+        return content;
+    if (!Array.isArray(content))
+        return '';
+    return content
+        .map((p) => (p && typeof p === 'object' && 'text' in p && typeof p.text === 'string' ? p.text : ''))
+        .join(' ')
+        .trim();
+}
+/** distill durable-fact texts from a finished conversation (ModelMessage[]-shaped). Pure. */
+export function distilledFactsFromMessages(messages) {
+    return distillSession(messages.map((m) => ({ role: m.role, text: messageText(m.content) }))).map((c) => c.text);
+}

package/dist/session.js

@@ -1,7 +1,7 @@
 import { chmod, readFile, writeFile, mkdir, readdir, realpath, rm } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { appHomePath, persistenceEnabled } from './brand.js';
-import { redactKey } from './providers/keys.js';
+import { redactKey, redactUnknown } from './providers/keys.js';
 // session store — จำ conversation + ความคืบหน้า เพื่อ "ทำงานต่อได้" ไม่ลืมว่าทำถึงไหน
 const SESSION_DIR = appHomePath('sessions');
 function isRecord(value) {
@@ -45,16 +45,6 @@ function sessionFilePath(id) {
     }
     return join(SESSION_DIR, `${id}.json`);
 }
-function redactUnknown(value) {
-    if (typeof value === 'string')
-        return redactKey(value);
-    if (Array.isArray(value))
-        return value.map(redactUnknown);
-    if (value && typeof value === 'object') {
-        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, redactUnknown(v)]));
-    }
-    return value;
-}
 function sanitizeSession(s) {
     return {
         ...s,

package/dist/skill-install.js

@@ -6,7 +6,7 @@ import { promisify } from 'node:util';
 import { randomUUID } from 'node:crypto';
 import { lookup } from 'node:dns/promises';
 import { isIP } from 'node:net';
-import { parseFrontmatter, isValidSkillName } from './skills.js';
+import { parseFrontmatter, isValidSkillName, bundledSkillsDir, listBundledSkills } from './skills.js';
 import { appHomePath, BRAND } from './brand.js';
 const execFileAsync = promisify(execFile);
 const USER_SKILLS = appHomePath('skills');
@@ -172,6 +172,29 @@ async function fetchSkillMd(url) {
         throw new Error('SKILL.md ใหญ่เกิน 2MB');
     return text;
 }
+function bundledCatalogHint(name) {
+    const sample = ['git-commit-pr', 'write-tests', 'debug-root-cause'];
+    return `ไม่เจอ bundled skill "${name}" — ลอง ${sample.join(', ')} หรือ ${BRAND.cliName} skill list`;
+}
+/**
+ * ติดตั้ง skill จาก bundled catalog (ชื่อ slug) · local path · URL · GitHub
+ * ⚠️ skill = instruction ที่ agent จะ trust (ไม่ใช่ data) — ติดตั้งจาก source ที่เชื่อถือเท่านั้น
+ */
+export async function installNamedSkill(nameOrSource, onLog) {
+    if (await exists(nameOrSource))
+        return installFromLocal(nameOrSource, onLog);
+    if (isValidSkillName(nameOrSource)) {
+        const bundled = join(bundledSkillsDir(), nameOrSource);
+        if (await exists(join(bundled, 'SKILL.md')))
+            return [await installFromDir(bundled)];
+        const catalog = await listBundledSkills();
+        const match = catalog.find((skill) => skill.name === nameOrSource);
+        if (match)
+            return [await installFromDir(dirname(dirname(match.path)))];
+        throw new Error(bundledCatalogHint(nameOrSource));
+    }
+    return installSkill(nameOrSource, onLog);
+}
 /**
  * ติดตั้ง skill จาก source — local path · URL ของ SKILL.md (https) · GitHub ("user/repo" หรือ "user/repo/sub/path")
  * ⚠️ skill = instruction ที่ agent จะ trust (ไม่ใช่ data) — ติดตั้งจาก source ที่เชื่อถือเท่านั้น

package/dist/skills.js

@@ -9,6 +9,9 @@ import { projectConfigPathIfTrusted } from './trust.js';
 // 3 ชั้น: bundled (ship กับ CLI) → global (~/.sanook) → project (.sanook) — ชั้นหลัง override ชื่อซ้ำ
 const BUNDLED_SKILLS = join(dirname(fileURLToPath(import.meta.url)), '..', 'skills');
 const GLOBAL_SKILLS = appHomePath('skills');
+export function bundledSkillsDir() {
+    return BUNDLED_SKILLS;
+}
 /** minimal frontmatter parser (key: value ใน --- block) — ไม่พึ่ง YAML dep */
 export function parseFrontmatter(content) {
     const m = content.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
@@ -33,6 +36,36 @@ export function parseFrontmatter(content) {
 export function isValidSkillName(name) {
     return /^[a-z0-9][a-z0-9-]{0,63}$/.test(name);
 }
+/** list bundled skills only (sanook skill install <name> catalog) */
+export async function listBundledSkills() {
+    const out = [];
+    let entries;
+    try {
+        entries = await readdir(BUNDLED_SKILLS, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const e of entries) {
+        if (!e.isDirectory() || !isValidSkillName(e.name))
+            continue;
+        const p = join(BUNDLED_SKILLS, e.name, 'SKILL.md');
+        try {
+            const { meta } = parseFrontmatter(await readFile(p, 'utf8'));
+            const name = meta.name && isValidSkillName(meta.name) ? meta.name : e.name;
+            out.push({
+                name,
+                description: meta.description ?? '',
+                whenToUse: meta.when_to_use,
+                path: p,
+            });
+        }
+        catch {
+            /* skip invalid entries */
+        }
+    }
+    return out.sort((a, b) => a.name.localeCompare(b.name));
+}
 /** scan project + global skills → list (name+description เท่านั้น สำหรับ inject). project ทับ global ชื่อซ้ำ */
 export async function loadSkills(cwd = process.cwd()) {
     const out = new Map();