shelfware 0.1.2 → 0.1.3

package/.output/nitro.json

@@ -1,5 +1,5 @@
 {
-  "date": "2026-09-06T17:42:05.675Z",
+  "date": "2026-09-20T15:39:57.442Z",
   "preset": "node-server",
   "framework": {
     "name": "nuxt",

package/.output/public/_nuxt/builds/latest.json

@@ -1 +1 @@
-{"id":"bc384f67-a2f8-4b6b-9aa1-cb68fb93d366","timestamp":1788716517486}
+{"id":"87d7ca63-ebd6-4c54-a087-e23ce5bed209","timestamp":1789918788535}

package/.output/public/_nuxt/builds/meta/87d7ca63-ebd6-4c54-a087-e23ce5bed209.json

@@ -0,0 +1 @@
+{"id":"87d7ca63-ebd6-4c54-a087-e23ce5bed209","timestamp":1789918788535,"prerendered":[]}

package/.output/server/chunks/_/catalog.mjs

@@ -587,6 +587,7 @@ const SKIP_HOME_DOTDIRS = /* @__PURE__ */ new Set([
   ".skill-cabinet"
 ]);
 const SKIP_WALK = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".cache", "upstream"]);
+const PLUGIN_SPLITS = ["cache", "marketplaces"];
 function pathExists(p) {
   try {
     return fs.existsSync(p);
@@ -617,7 +618,20 @@ function idFor(absPath) {
   return nodeCrypto.createHash("sha1").update(absPath).digest("hex").slice(0, 16);
 }
 const NAMED_SKILL_FILES = /* @__PURE__ */ new Set(["skill.md", "SKILL.md"]);
-const IGNORE_LOOSE_MD = /* @__PURE__ */ new Set(["readme.md", "changelog.md", "license.md", "licence.md"]);
+const IGNORE_LOOSE_MD = /* @__PURE__ */ new Set([
+  "readme.md",
+  "readme.es.md",
+  "readme.ko.md",
+  "changelog.md",
+  "license.md",
+  "licence.md",
+  "description.md",
+  "security.md",
+  "contributing.md",
+  "pull_request_template.md",
+  "access.md",
+  "benchmark.md"
+]);
 function isSkillFileName(name) {
   if (NAMED_SKILL_FILES.has(name)) return true;
   if (!/\.md$/i.test(name)) return false;
@@ -690,11 +704,19 @@ function discoverRoots(opts) {
     const base = path.join(home, entry.name);
     const scopeId = entry.name.slice(1);
     for (const folder of ["skills", "skill"]) {
-      add(scopeId, entry.name, path.join(base, folder), "user", false);
+      add(scopeId, entry.name, path.join(base, folder), "user", false, true);
+    }
+    const pluginsRoot = path.join(base, "plugins");
+    const splits = PLUGIN_SPLITS.filter((name) => isDir(path.join(pluginsRoot, name)));
+    if (splits.length > 0) {
+      for (const name of splits) {
+        add(`${scopeId}-plugins-${name}`, `${entry.name}/plugins/${name}`, path.join(pluginsRoot, name), "plugin", true, true);
+      }
+    } else {
+      add(`${scopeId}-plugins`, `${entry.name}/plugins`, pluginsRoot, "plugin", true, true);
     }
     if (entry.name === ".cursor") {
       add("cursor-builtin", ".cursor/skills-cursor", path.join(base, "skills-cursor"), "builtin", false);
-      add("cursor-plugins", ".cursor/plugins", path.join(base, "plugins"), "plugin", true);
     }
   }
   add("gemini", ".gemini/antigravity", path.join(home, ".gemini/antigravity/skills"), "user", false);
@@ -741,7 +763,7 @@ function collectDirectSkills(root, list, nested = false, depth = 0) {
       const skillMd = findSkillFile(abs);
       if (skillMd) {
         list.push({ dir: abs, skillMd, root, ...install, file: false });
-      } else if (nested) {
+      } else if (nested && !install.link) {
         collectDirectSkills({ ...root, root: abs }, list, true, depth + 1);
       }
       continue;
@@ -756,7 +778,7 @@ function walkSkillContainers(dir, root, list, depth = 0) {
   const entries = readDirents(dir);
   const base = path.basename(dir);
   if (base === "skills" || base === "skill") {
-    collectDirectSkills({ ...root, root: dir }, list);
+    collectDirectSkills({ ...root, root: dir }, list, root.deep === true);
     return;
   }
   for (const entry of entries) {
@@ -974,10 +996,10 @@ function scanRoots(roots, opts) {
   const realpaths = /* @__PURE__ */ new Map();
   const found = [];
   for (const root of roots) {
-    if (root.deep) {
-      collectDirectSkills(root, found, true);
-    } else if (root.recursive) {
+    if (root.recursive) {
       walkSkillContainers(root.root, root, found);
+    } else if (root.deep) {
+      collectDirectSkills(root, found, true);
     } else {
       collectDirectSkills(root, found);
     }
@@ -1074,6 +1096,9 @@ function assertSkillTarget(summary, roots, action = "delete", opts) {
   const target = path.resolve(summary.path);
   const inside = roots.some((r) => contained(target, r.root));
   if (!inside) throw fail(403, "Skill is outside known cabinet roots");
+  const real = path.join(realPath(path.dirname(target)), path.basename(target));
+  const reallyInside = roots.some((r) => contained(real, realPath(r.root)));
+  if (!reallyInside) throw fail(403, "Skill resolves outside known cabinet roots");
   const isRoot = roots.some((r) => path.resolve(r.root) === target);
   if (isRoot || target === homeOf(opts)) throw fail(403, `Refusing to ${action} a cabinet root`);
   const install = describeInstall(target);

package/.output/server/chunks/nitro/nitro.mjs

@@ -4056,7 +4056,7 @@ function _expandFromEnv(value) {
 const _inlineRuntimeConfig = {
   "app": {
     "baseURL": "/",
-    "buildId": "bc384f67-a2f8-4b6b-9aa1-cb68fb93d366",
+    "buildId": "87d7ca63-ebd6-4c54-a087-e23ce5bed209",
     "buildAssetsDir": "/_nuxt/",
     "cdnURL": ""
   },
@@ -4574,107 +4574,107 @@ const assets = {
   "/_nuxt/BDNMzG2s.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"54-MasMfSk/A98C3Gn9uIOxtFxkWNw\"",
-    "mtime": "2026-09-06T17:42:02.389Z",
+    "mtime": "2026-09-20T15:39:53.933Z",
     "size": 84,
     "path": "../public/_nuxt/BDNMzG2s.js"
   },
   "/_nuxt/BW3xJdEx.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"2da-zDmvCG/tLW/peRiDRHBkm+3Edw4\"",
-    "mtime": "2026-09-06T17:42:02.389Z",
+    "mtime": "2026-09-20T15:39:53.933Z",
     "size": 730,
     "path": "../public/_nuxt/BW3xJdEx.js"
   },
   "/_nuxt/Bzmuhhqm.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"d4e-gP63vGSa9YNUx8rX9IMYEHDofck\"",
-    "mtime": "2026-09-06T17:42:02.389Z",
+    "mtime": "2026-09-20T15:39:53.933Z",
     "size": 3406,
     "path": "../public/_nuxt/Bzmuhhqm.js"
   },
   "/_nuxt/CJmYvhe6.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"e90-WCRBrvGTpCy77xWxtXI2/olAzuA\"",
-    "mtime": "2026-09-06T17:42:02.389Z",
+    "mtime": "2026-09-20T15:39:53.933Z",
     "size": 3728,
     "path": "../public/_nuxt/CJmYvhe6.js"
   },
   "/_nuxt/CMk5jOCS.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"1c01-lGS5cFf7bjhmRvkeRxUtYYhz3dw\"",
-    "mtime": "2026-09-06T17:42:02.389Z",
+    "mtime": "2026-09-20T15:39:53.933Z",
     "size": 7169,
     "path": "../public/_nuxt/CMk5jOCS.js"
   },
-  "/_nuxt/DJQqUjJu.js": {
-    "type": "text/javascript; charset=utf-8",
-    "etag": "\"9f1d-Ja0Ka8FFBfh/wxDphcm6zq2k/Aw\"",
-    "mtime": "2026-09-06T17:42:02.389Z",
-    "size": 40733,
-    "path": "../public/_nuxt/DJQqUjJu.js"
-  },
   "/_nuxt/DfJzPSBi.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"1c1-4bfhhLtFN8RKoheWCeIIphoXgv0\"",
-    "mtime": "2026-09-06T17:42:02.389Z",
+    "mtime": "2026-09-20T15:39:53.933Z",
     "size": 449,
     "path": "../public/_nuxt/DfJzPSBi.js"
   },
+  "/_nuxt/DJQqUjJu.js": {
+    "type": "text/javascript; charset=utf-8",
+    "etag": "\"9f1d-Ja0Ka8FFBfh/wxDphcm6zq2k/Aw\"",
+    "mtime": "2026-09-20T15:39:53.933Z",
+    "size": 40733,
+    "path": "../public/_nuxt/DJQqUjJu.js"
+  },
   "/_nuxt/error-404.1qC5mjOI.css": {
     "type": "text/css; charset=utf-8",
     "etag": "\"97d-ClY1xVMSVUOi3w+npB6k6oGQGlM\"",
-    "mtime": "2026-09-06T17:42:02.389Z",
+    "mtime": "2026-09-20T15:39:53.933Z",
     "size": 2429,
     "path": "../public/_nuxt/error-404.1qC5mjOI.css"
   },
   "/_nuxt/error-500.BcOmuN7K.css": {
     "type": "text/css; charset=utf-8",
     "etag": "\"772-O0XjmZiN9Tmmh4xccNArXpeMXMg\"",
-    "mtime": "2026-09-06T17:42:02.390Z",
+    "mtime": "2026-09-20T15:39:53.933Z",
     "size": 1906,
     "path": "../public/_nuxt/error-500.BcOmuN7K.css"
   },
   "/_nuxt/EBA28doP.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"25526-S2M2g51QVQiD0lfERMcQ2TJCNvo\"",
-    "mtime": "2026-09-06T17:42:02.389Z",
+    "mtime": "2026-09-20T15:39:53.933Z",
     "size": 152870,
     "path": "../public/_nuxt/EBA28doP.js"
   },
   "/_nuxt/entry.CKteCcdN.css": {
     "type": "text/css; charset=utf-8",
     "etag": "\"300c8-0WAu9DRw8xrNZdnpJNGrjxOdjtk\"",
-    "mtime": "2026-09-06T17:42:02.389Z",
+    "mtime": "2026-09-20T15:39:53.933Z",
     "size": 196808,
     "path": "../public/_nuxt/entry.CKteCcdN.css"
   },
+  "/_nuxt/builds/latest.json": {
+    "type": "application/json",
+    "etag": "\"47-tWu0moVuUg+mZHEvO0WlAqsbf7Q\"",
+    "mtime": "2026-09-20T15:39:53.925Z",
+    "size": 71,
+    "path": "../public/_nuxt/builds/latest.json"
+  },
   "/_nuxt/sK9Xse3o.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"16ebc-llACAH/LeVfHtbCyV/Od8ae+rn8\"",
-    "mtime": "2026-09-06T17:42:02.390Z",
+    "mtime": "2026-09-20T15:39:53.933Z",
     "size": 93884,
     "path": "../public/_nuxt/sK9Xse3o.js"
   },
-  "/_nuxt/builds/latest.json": {
+  "/_nuxt/builds/meta/87d7ca63-ebd6-4c54-a087-e23ce5bed209.json": {
     "type": "application/json",
-    "etag": "\"47-y/Uibk2CT3wmZ2jWKLpHXHWksOc\"",
-    "mtime": "2026-09-06T17:42:02.382Z",
-    "size": 71,
-    "path": "../public/_nuxt/builds/latest.json"
+    "etag": "\"58-4wd6NcE3wBxF/Zfjr3lBrhnNofg\"",
+    "mtime": "2026-09-20T15:39:53.921Z",
+    "size": 88,
+    "path": "../public/_nuxt/builds/meta/87d7ca63-ebd6-4c54-a087-e23ce5bed209.json"
   },
   "/_nuxt/rWsrwf2L.js": {
     "type": "text/javascript; charset=utf-8",
     "etag": "\"7606d-30wm5zPsBwgXACgEnaCLHx2ZHVk\"",
-    "mtime": "2026-09-06T17:42:02.390Z",
+    "mtime": "2026-09-20T15:39:53.933Z",
     "size": 483437,
     "path": "../public/_nuxt/rWsrwf2L.js"
-  },
-  "/_nuxt/builds/meta/bc384f67-a2f8-4b6b-9aa1-cb68fb93d366.json": {
-    "type": "application/json",
-    "etag": "\"58-t+Qo1Xc7SXVzy2SU0Q6z9Np3At0\"",
-    "mtime": "2026-09-06T17:42:02.343Z",
-    "size": 88,
-    "path": "../public/_nuxt/builds/meta/bc384f67-a2f8-4b6b-9aa1-cb68fb93d366.json"
   }
 };
 

package/.output/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shelfware-prod",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "private": true,
   "dependencies": {

package/README.md

@@ -2,7 +2,11 @@
 
 shelfware finds the shelfware in your skill drawers.
 
-A local catalog of the AI-agent skills installed on this machine: every `~/.<tool>/skills` drawer (`~/.claude/skills`, `~/.cursor/skills`, `~/.codex/skills`, `~/.agents/skills`, a custom `~/.claude-work/skills`, …), Cursor plugins, Gemini Antigravity, Hermes profiles, and friends. It scans, lists, searches, renders, **edits**, audits, quarantines, restores, and permanently deletes skills, from a browser tab that only your machine can reach.
+A local catalog of the AI-agent skills installed on this machine: every `~/.<tool>/skills` drawer (`~/.claude/skills`, `~/.cursor/skills`, `~/.codex/skills`, `~/.agents/skills`, a custom `~/.claude-work/skills`, …), the plugin trees beside them (`~/.<tool>/plugins`, split into the installed `cache` and `marketplaces` checkouts where a tool keeps them apart — one `plugins` drawer otherwise), Cursor's own builtin drawer (`~/.cursor/skills-cursor`), Gemini Antigravity, Hermes profiles, and friends. It scans, lists, searches, renders, **edits**, audits, quarantines, restores, and permanently deletes skills, from a browser tab that only your machine can reach.
+
+![shelfware in dark mode: drawers on the left, the card list in the middle, the selected skill with its audit finding on the right](docs/screenshot_dark.png)
+
+![shelfware in light mode](docs/screenshot_light.png)
 
 ## Run it
 
@@ -16,16 +20,16 @@ Node 20 or newer. No build step: the package ships the prebuilt app. For a perma
 
 ### First run
 
-Starting shelfware only reads. It walks the hidden directories directly under your home (`$HOME`), skipping caches and toolchains, and picks up every `skills/` (or `skill/`) folder it finds, plus the Cursor, Gemini Antigravity and Hermes locations above. Nothing on disk changes until you quarantine, restore, delete or save a skill yourself.
+Starting shelfware only reads. It walks the hidden directories directly under your home (`$HOME`), skipping caches and toolchains, and picks up every `skills/` (or `skill/`) folder it finds — including skills grouped into sub-folders inside it, such as `~/.codex/skills/.system/<skill>` — plus each tool's `plugins/` tree and the Cursor, Gemini Antigravity and Hermes locations above. Inside a plugin tree only folders named `skills/` (or `skill/`) are read, so a plugin's own README, its `docs/`, and its source outside those folders are never catalogued; inside those folders, familiar repository documents — README, CHANGELOG, LICENCE, CONTRIBUTING, SECURITY and the rest of a short ignore list — are skipped, while any other loose `*.md` still becomes a card. Nothing on disk changes until you quarantine, restore, delete or save a skill yourself.
 
-Skills outside your home directory (project-level `.claude/skills` inside a repository, an arbitrary path) are not scanned in v0.1; a `--root <path>` flag is planned. To scan a different home, run `HOME=/other/home npx shelfware@latest`.
+Skills outside your home directory (project-level `.claude/skills` inside a repository, an arbitrary path) are not scanned; a `--root <path>` flag is planned. To scan a different home, run `HOME=/other/home npx shelfware@latest`.
 
 ### Troubleshooting
 
 - **`npx shelfware` prints "coming soon".** Your npx cache still holds the `0.0.1` placeholder. Run `npx shelfware@latest` once; npx then caches the real release.
 - **The browser did not open.** Copy the URL from the `shelfware at http://127.0.0.1:<port>` line, or start with `--no-open` and open it yourself.
 - **Port in use.** An explicit `--port <n>` that is taken is refused at once with a one-line message; without either the flag or PORT shelfware tries 3781 through 3800. A typo in a flag prints the message and the help text instead of a stack trace.
-- **The catalog is empty.** Check that your skills live under `$HOME/.<tool>/skills`; other locations are not scanned yet.
+- **The catalog is empty.** Check that your skills live under `$HOME/.<tool>/skills`, `$HOME/.<tool>/plugins`, or one of the Cursor, Gemini Antigravity or Hermes locations above; other locations are not scanned yet.
 
 ## What you get
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shelfware",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "shelfware finds the shelfware in your skill drawers.",
   "keywords": [
     "skills",

package/.output/public/_nuxt/builds/meta/bc384f67-a2f8-4b6b-9aa1-cb68fb93d366.json

@@ -1 +0,0 @@
-{"id":"bc384f67-a2f8-4b6b-9aa1-cb68fb93d366","timestamp":1788716517486,"prerendered":[]}