simple-skill-manager 0.1.0

package/README.md

@@ -0,0 +1,116 @@
+**English** | [中文](README.zh-CN.md)
+
+# Simple Skill Manager
+
+A local web app that gathers the **skills** scattered across your AI coding agents (Claude Code, Codex, Gemini CLI, OpenClaw, Kimi, and more — 13 agents auto-detected) into **one deduplicated, source-classified library**, and lets you decide which agent gets which skill with a single click. It also gives you a **read-only overview of your MCP configs**.
+
+Runs entirely on your machine. No cloud, no account.
+
+## Features
+
+- **Auto-detects installed agents** (13 adapters) and scans their skill directories
+- **Deduplication by content hash** — same content under different names collapses into one row; same name with different content stays separate (never silently merged)
+- **Central library** — adopt a skill into the library once, and each agent gets a symlink (or a copy, for agents that don't follow symlinks)
+- **Per-agent enable / disable** — one click on an agent avatar
+- **Idle skills** — keep a skill in the library without handing it to any agent (filter for them in My Library)
+- **Duplicate merge, safe rename, tags** — rename updates the folder, the `name:` field, and every agent link at once
+- **Update check** — only for skills with a recorded `git_url` origin; hand-written local skills are never touched
+- **GitHub backup & multi-machine sync** — back the library up to a private repo of your own; destructive operations take an automatic local git snapshot first
+- **Marketplace** — browse and install skills from skills.sh (with a built-in offline catalog)
+- **MCP overview** — read-only view of MCP configs across JSON / TOML / YAML formats, secrets masked by default
+- **Bilingual UI** — English by default, switch to 中文 with the toggle at the bottom of the sidebar (remembered across sessions)
+
+## Safety model
+
+The first launch does a **read-only scan and changes nothing**. After that, the tool only ever writes inside two roots:
+
+| Env var            | Meaning                                                        | Default                     |
+| ------------------ | -------------------------------------------------------------- | --------------------------- |
+| `SSM_AGENT_ROOT` | Root under which agent dirs (`.claude`, `.codex`, …) live | your real `$HOME`         |
+| `SSM_DATA_DIR`   | Central library + SQLite DB + config                           | `~/.simple-skill-manager` |
+
+Writes outside these roots are rejected (realpath-checked, symlink escapes blocked). It also **never overwrites a same-named skill it doesn't manage** — your hand-written files are safe.
+
+## Quick start
+
+Requires **Node.js 18+**. The fastest way — no clone, no build:
+
+```bash
+npx simple-skill-manager             # run against your real home dir (port 3000)
+npx simple-skill-manager --sandbox   # try it safely first: fake data, real files untouched
+npx simple-skill-manager --port 4000 # pick a port
+```
+
+The server listens on `127.0.0.1` only, so it's never reachable from your network. Stop it with Ctrl+C.
+
+**Recommended first step: sandbox mode.** This tool moves / symlinks / copies / deletes files inside your agent directories, so play with a fake directory tree first (`--sandbox`), then run it for real once you're comfortable.
+
+### From a git clone (for development)
+
+```bash
+./start.sh              # production build + run against your real $HOME (port 3000)
+./start.sh --sandbox    # sandbox: fake data, real files untouched (port 3210)
+./dev.sh                # dev mode: no build step, hot reload
+./stop.sh               # stop the running server
+```
+
+> `dev.sh` vs `start.sh`: `dev.sh` hot-reloads as you edit code; `start.sh` serves a frozen production build — after changing code you must `./stop.sh && ./start.sh` again.
+
+## Quick start (Windows)
+
+The `.sh` scripts are bash-only (they run under Git Bash / WSL). Native PowerShell or cmd works with plain npm commands:
+
+```powershell
+npm install     # installs native better-sqlite3 (prebuilt binaries in most cases)
+npm run build
+npm run start   # → http://localhost:3000 (scans your real %USERPROFILE%)
+# or, for development with hot reload:  npm run dev
+```
+
+> **Symlinks on Windows** require Developer Mode (Settings → Privacy & security → For developers) or an admin terminal. Don't want either? Switch agents to **copy mode** in Settings — no special permissions needed.
+
+## Sandbox mode, manually
+
+```bash
+node scripts/build-sandbox.mjs        # builds a fake agent tree under .ssm-sandbox/
+SSM_AGENT_ROOT="$PWD/.ssm-sandbox/home" \
+SSM_DATA_DIR="$PWD/.ssm-sandbox/data" \
+  npx next dev -p 3210
+```
+
+## Core concepts
+
+| Action                       | Meaning                                                                                                                                    |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
+| **Import**             | Move a scattered skill into the central library; the original location becomes a symlink (or copy)                                         |
+| **Enable / Disable**   | Toggle a skill for one specific agent                                                                                                      |
+| **Idle**               | In the library, but handed to no agent — saved for later                                                                                  |
+| **Move to My Library** | Duplicate an agent's built-in skill as your own (copy only, original untouched)                                                            |
+| **Rename**             | Safe rename: updates `SKILL.md` `name:`, the folder, and every agent link (renaming the folder by hand in a file manager breaks links) |
+| **Tags**               | Per-skill tags for filtering, plus global tag rename / delete in Settings                                                                  |
+
+## GitHub backup & sync
+
+Settings → "GitHub backup & sync" backs your **skill library** up to a **private** GitHub repo of yours and syncs it across machines (uses your logged-in `gh` CLI).
+
+- **Backup now** (local → cloud): push only, never touches local files
+- **Sync from cloud** (cloud → local): merge, keeps local changes
+- **Restore cloud version** (cloud → local): overwrite — an automatic local restore point is created first
+- What syncs: skill files + `manifest.json` (hashes, origins, tags). What doesn't: which agent uses which skill — each machine decides that for itself.
+- Cross-platform content hashes are kept identical via `.gitattributes eol=lf` (tested macOS ↔ Windows)
+
+## Tests
+
+```bash
+npm test          # unit + safety regression tests
+npm run build     # production build
+npm run typecheck # tsc --noEmit
+```
+
+## Tech stack
+
+Next.js 15 (App Router) · TypeScript · Tailwind CSS · better-sqlite3 · SWR · Vitest
+
+## License
+
+[MIT](LICENSE)

package/README.zh-CN.md

@@ -0,0 +1,120 @@
+[English](README.md) | **中文**
+
+# 技能管理台 · Simple Skill Manager
+
+把散落在各个 AI 工具（Claude Code / Codex / Gemini CLI / OpenClaw / Kimi …，自动识别 13 种 Agent）里的
+skill，收拢成**一份去重、按来源分类的干净清单**，点一下决定哪个 Agent 能用，并提供
+MCP 配置的**只读总览**。
+
+完全本地运行、无云端、无账号。界面默认英文，侧边栏底部可切中文（选择会被记住）。
+
+## 功能
+
+- **自动检测已安装的 Agent**（13 个适配器），扫描各自的 skill 目录
+- **内容哈希去重** —— 同内容不同名合成一行；同名不同内容当成两个，绝不静默合并
+- **中央库** —— 收入库一次，每个 Agent 得到一个软链（不认软链的 Agent 用拷贝）
+- **按 Agent 启用 / 停用** —— 点头像即可
+- **闲置** —— 留在库里、暂不分发给任何 Agent（在「我的库」里可筛选）
+- **重复合并、安全重命名、标签** —— 重命名会同时改文件夹、`name:` 字段和所有 Agent 链接
+- **检查更新** —— 只认显式记录了 `git_url` 来源的 skill；本地手写的绝不误动
+- **GitHub 备份与多机同步** —— 备份到你自己的私有仓库；破坏性操作前自动留本地 git 快照
+- **市场** —— 浏览并安装 skills.sh 上的 skill（离线有内置目录）
+- **MCP 总览** —— 只读展示 JSON / TOML / YAML 各格式的 MCP 配置，密钥默认打码
+
+## 安全机制
+
+首次打开只做**只读扫描，不动任何文件**。之后工具永远只写这两个根目录之内：
+
+| 环境变量 | 含义 | 默认 |
+|---|---|---|
+| `SSM_AGENT_ROOT` | 扫描 / 改动的 agent 目录根 | 真实 `$HOME` |
+| `SSM_DATA_DIR` | 中央库 + SQLite + 配置所在 | `~/.simple-skill-manager` |
+
+写出根目录之外会被拒绝（realpath 校验，软链逃逸也挡）。同名但**不归本工具管理**的 skill 绝不覆盖——你手写的文件是安全的。
+
+## 快速开始
+
+需要 **Node.js 18+**。最省事——不用 clone、不用构建：
+
+```bash
+npx simple-skill-manager             # 指向你真实的家目录（端口 3000）
+npx simple-skill-manager --sandbox   # 先安全试玩：假数据、不碰真实文件
+npx simple-skill-manager --port 4000 # 指定端口
+```
+
+服务只监听 `127.0.0.1`，别的机器连不上。按 Ctrl+C 停止。
+
+**推荐第一步先跑沙箱。** 这个工具会移动 / 软链 / 拷贝 / 删除 Agent 目录里的文件，
+先在假目录树里把玩（`--sandbox`），确认行为后再正式用。
+
+### 从 git clone 跑（开发用）
+
+```bash
+./start.sh              # 生产模式：构建并启动，指向你真实 $HOME（端口 3000）
+./start.sh --sandbox    # 沙箱模式：假数据、不碰真实文件（端口 3210）
+./dev.sh                # 开发模式：免构建、改代码自动刷新
+./stop.sh               # 停掉正在运行的服务
+```
+
+> `dev.sh` 和 `start.sh` 的区别：`dev.sh` 改代码自动热刷新；`start.sh` 伺服的是启动那一刻的构建，
+> 改完代码必须 `./stop.sh && ./start.sh` 重来才生效。
+
+## 快速开始（Windows）
+
+`.sh` 脚本只能在 Git Bash / WSL 里跑；原生 PowerShell 或 cmd 直接用 npm 命令：
+
+```powershell
+npm install     # 会装原生 better-sqlite3（通常有预编译包）
+npm run build
+npm run start   # → http://localhost:3000（扫描你真实的 %USERPROFILE%）
+# 想边改边看（热刷新）：npm run dev
+```
+
+> **Windows 软链权限**：建软链需要开发者模式（设置 → 隐私和安全性 → 开发者选项）或管理员终端。
+> 不想开也行：到设置页把对应 Agent 切成**拷贝模式**，无需任何权限。
+
+## 手动进沙箱
+
+```bash
+node scripts/build-sandbox.mjs        # 在 .ssm-sandbox/ 造一棵假的 agent 目录树
+SSM_AGENT_ROOT="$PWD/.ssm-sandbox/home" \
+SSM_DATA_DIR="$PWD/.ssm-sandbox/data" \
+  npx next dev -p 3210
+```
+
+## 核心概念
+
+| 操作 | 含义 |
+|---|---|
+| **收入库** | 把散落各处的 skill 收进中央库，原处换成软链（不认软链的 Agent 用拷贝） |
+| **启用 / 停用** | 对某个具体 Agent 开关这个 skill |
+| **闲置** | 在库里、但没分发给任何 Agent —— 留着以后用 |
+| **移到我的库** | 把 Agent 自带的 skill 复制一份变成"我的"（只复制不删原件） |
+| **重命名** | 安全改名：同时改 `SKILL.md` 的 `name:`、文件夹名和所有 Agent 链接（别在文件管理器里直接改文件夹名，会断链） |
+| **标签** | 给 skill 打标签便于筛选；设置页可全局重命名 / 删除标签 |
+
+## GitHub 备份与多机同步
+
+设置页「GitHub 备份与同步」把你的**技能库**备份到你自己的**私有** GitHub 仓库，并在多台机器间同步（用你已登录的 `gh` CLI）。
+
+- **⬆ 立即备份**（本地 → 云端）：只上传，绝不改动本地文件
+- **⬇ 从云端同步**（云端 → 本地）：合并，保留本地改动
+- **↺ 恢复到云端版本**（云端 → 本地）：覆盖 —— 恢复前自动留一个本地还原点
+- 同步的是：技能文件 + `manifest.json`（哈希、来源、标签）；**不同步**「哪个 Agent 用哪个技能」——每台机器各自决定
+- 跨平台内容哈希靠 `.gitattributes eol=lf` 两端保持一致（已测 macOS ↔ Windows）
+
+## 测试
+
+```bash
+npm test          # 单元测试 + 安全护栏回归
+npm run build     # 生产构建
+npm run typecheck # tsc --noEmit
+```
+
+## 技术栈
+
+Next.js 15 (App Router) · TypeScript · Tailwind CSS · better-sqlite3 · SWR · Vitest
+
+## 许可证
+
+[MIT](LICENSE)

package/bin/cli.mjs

@@ -0,0 +1,128 @@
+#!/usr/bin/env node
+// Simple Skill Manager — npx launcher.
+//
+//   npx simple-skill-manager               # run against your real $HOME (port 3000)
+//   npx simple-skill-manager --sandbox     # try safely on fake data (port 3210)
+//   npx simple-skill-manager --port 4000
+import { spawn, spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { createServer } from "node:net";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const pkgRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const require = createRequire(path.join(pkgRoot, "package.json"));
+const pkg = JSON.parse(fs.readFileSync(path.join(pkgRoot, "package.json"), "utf8"));
+
+// ---------- args ----------
+const argv = process.argv.slice(2);
+let sandbox = false;
+let port = null;
+for (let i = 0; i < argv.length; i++) {
+  const a = argv[i];
+  if (a === "--sandbox") sandbox = true;
+  else if (a === "--port" || a === "-p") port = Number(argv[++i]);
+  else if (a.startsWith("--port=")) port = Number(a.slice(7));
+  else if (a === "--version" || a === "-v") {
+    console.log(pkg.version);
+    process.exit(0);
+  } else if (a === "--help" || a === "-h") {
+    console.log(`Simple Skill Manager ${pkg.version}
+
+Usage:
+  npx simple-skill-manager               run against your real home dir (port 3000)
+  npx simple-skill-manager --sandbox     safe trial on a fake agent tree (port 3210)
+  npx simple-skill-manager --port 4000   pick a port
+
+The server listens on 127.0.0.1 only (not reachable from your network).
+Stop with Ctrl+C.`);
+    process.exit(0);
+  } else {
+    console.error(`Unknown option: ${a} (try --help)`);
+    process.exit(1);
+  }
+}
+if (port !== null && (!Number.isInteger(port) || port < 1 || port > 65535)) {
+  console.error("Invalid --port value.");
+  process.exit(1);
+}
+if (port === null) port = sandbox ? 3210 : 3000;
+
+// ---------- helpers ----------
+function portFree(p) {
+  return new Promise((resolve) => {
+    const srv = createServer();
+    srv.once("error", () => resolve(false));
+    srv.once("listening", () => srv.close(() => resolve(true)));
+    srv.listen(p, "127.0.0.1");
+  });
+}
+
+async function pickPort(start) {
+  for (let p = start; p < start + 20; p++) {
+    if (await portFree(p)) {
+      if (p !== start) console.log(`Port ${start} is busy — using ${p} instead.`);
+      return p;
+    }
+  }
+  console.error(`No free port found near ${start}. Pass one with --port.`);
+  process.exit(1);
+}
+
+function nextBin() {
+  try {
+    return require.resolve("next/dist/bin/next");
+  } catch {
+    console.error("Could not find Next.js — the package seems broken. Try reinstalling.");
+    process.exit(1);
+  }
+}
+
+// ---------- sandbox ----------
+const env = { ...process.env };
+if (sandbox) {
+  const base = path.join(os.tmpdir(), `ssm-sandbox-${os.userInfo().username}`);
+  const r = spawnSync(
+    process.execPath,
+    [path.join(pkgRoot, "scripts", "build-sandbox.mjs"), base],
+    { stdio: "inherit" }
+  );
+  if (r.status !== 0) process.exit(r.status ?? 1);
+  env.SSM_AGENT_ROOT = path.join(base, "home");
+  env.SSM_DATA_DIR = path.join(base, "data");
+}
+
+// ---------- build check (npx from git builds via prepare; npm package ships .next) ----------
+if (!fs.existsSync(path.join(pkgRoot, ".next", "BUILD_ID"))) {
+  console.log("First run: building the app (one-time, takes a minute)…");
+  const r = spawnSync(process.execPath, [nextBin(), "build"], {
+    cwd: pkgRoot,
+    stdio: "inherit",
+    env,
+  });
+  if (r.status !== 0) {
+    console.error("Build failed — see the output above.");
+    process.exit(r.status ?? 1);
+  }
+}
+
+// ---------- start ----------
+const finalPort = await pickPort(port);
+console.log(
+  sandbox
+    ? `\n🏝️  Simple Skill Manager (SANDBOX — fake data, your real files are untouched)`
+    : `\n🏝️  Simple Skill Manager (scanning your real home: ${os.homedir()})`
+);
+console.log(`    http://localhost:${finalPort}\n    Stop with Ctrl+C.\n`);
+
+const child = spawn(
+  process.execPath,
+  [nextBin(), "start", "-p", String(finalPort), "-H", "127.0.0.1"],
+  { cwd: pkgRoot, stdio: "inherit", env }
+);
+child.on("exit", (code) => process.exit(code ?? 0));
+for (const sig of ["SIGINT", "SIGTERM"]) {
+  process.on(sig, () => child.kill(sig));
+}

package/next.config.mjs

@@ -0,0 +1,11 @@
+/** @type {import('next').NextConfig} */
+const nextConfig = {
+  // better-sqlite3 is a native module; keep it external to the server bundle.
+  serverExternalPackages: ["better-sqlite3"],
+  eslint: {
+    // Lint is run separately; don't fail production builds on style.
+    ignoreDuringBuilds: true,
+  },
+};
+
+export default nextConfig;

package/package.json

@@ -0,0 +1,73 @@
+{
+  "name": "simple-skill-manager",
+  "version": "0.1.0",
+  "description": "Local web app that gathers the skills scattered across your AI coding agents (Claude Code, Codex, Gemini CLI, …) into one deduplicated library, with per-agent enable/disable, MCP overview, marketplace and GitHub sync.",
+  "keywords": [
+    "skills",
+    "agent",
+    "claude-code",
+    "codex",
+    "gemini-cli",
+    "mcp",
+    "skill-manager"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AliZe198/simple-skill-manager.git"
+  },
+  "homepage": "https://github.com/AliZe198/simple-skill-manager#readme",
+  "bugs": {
+    "url": "https://github.com/AliZe198/simple-skill-manager/issues"
+  },
+  "type": "module",
+  "bin": {
+    "simple-skill-manager": "bin/cli.mjs"
+  },
+  "files": [
+    "bin",
+    ".next",
+    "!.next/cache",
+    "public",
+    "scripts",
+    "next.config.mjs",
+    "README.zh-CN.md"
+  ],
+  "engines": {
+    "node": ">=18.18.0"
+  },
+  "scripts": {
+    "dev": "next dev -H 127.0.0.1",
+    "build": "next build",
+    "start": "next start -H 127.0.0.1",
+    "lint": "next lint",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "prepack": "next build",
+    "prepare": "node scripts/prepare.mjs"
+  },
+  "dependencies": {
+    "@iarna/toml": "^2.2.5",
+    "better-sqlite3": "^12.11.1",
+    "classnames": "^2.5.1",
+    "next": "15.5.19",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "react-markdown": "^10.1.0",
+    "remark-gfm": "^4.0.1",
+    "swr": "^2.3.0",
+    "yaml": "^2.7.0"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.12",
+    "@types/node": "^22.10.7",
+    "@types/react": "^18.3.18",
+    "@types/react-dom": "^18.3.5",
+    "autoprefixer": "^10.4.20",
+    "postcss": "^8.5.1",
+    "tailwindcss": "^3.4.17",
+    "typescript": "^5.7.3",
+    "vitest": "^2.1.8"
+  }
+}

package/scripts/build-sandbox.mjs

@@ -0,0 +1,117 @@
+// Build a persistent sandbox agent tree for local dev so the running app
+// NEVER touches the real ~/.claude etc. Point the dev server at it via:
+//   SSM_AGENT_ROOT=.ssm-sandbox/home SSM_DATA_DIR=.ssm-sandbox/data
+import fs from "node:fs";
+import path from "node:path";
+
+// Optional argument overrides where the sandbox tree is built (used by bin/cli.mjs).
+const base = path.resolve(process.argv[2] || ".ssm-sandbox");
+fs.rmSync(base, { recursive: true, force: true });
+const root = path.join(base, "home");
+const dataDir = path.join(base, "data");
+fs.mkdirSync(root, { recursive: true });
+fs.mkdirSync(dataDir, { recursive: true });
+
+const dir = (p) => fs.mkdirSync(p, { recursive: true });
+const skill = (p, name, desc) => {
+  dir(p);
+  fs.writeFileSync(
+    path.join(p, "SKILL.md"),
+    `---\nname: ${name}\ndescription: ${desc}\n---\n\n# ${name}\n\n${desc}\n`
+  );
+  return p;
+};
+
+// Shared skill in .agents, symlinked from .claude
+const shared = skill(
+  path.join(root, ".agents/skills/google-flights"),
+  "google-flights",
+  "Search Google Flights for prices and schedules"
+);
+dir(path.join(root, ".claude/skills"));
+fs.symlinkSync(shared, path.join(root, ".claude/skills/google-flights"), "dir");
+
+skill(path.join(root, ".claude/skills/impeccable"), "impeccable", "Make a frontend interface impeccable");
+skill(path.join(root, ".claude/skills/frontend-design"), "frontend-design", "Create distinctive production-grade UIs");
+// duplicate content across two agents
+skill(path.join(root, ".claude/skills/better-auth"), "better-auth-best-practices", "Configure Better Auth in TypeScript");
+skill(path.join(root, ".codex/skills/better-auth"), "better-auth-best-practices", "Configure Better Auth in TypeScript");
+skill(path.join(root, ".gemini/skills/deep-research"), "deep-research", "Fan-out web research with citations");
+skill(path.join(root, ".openclaw/skills/xlsx"), "xlsx", "Create and edit spreadsheets");
+
+// A suite: several skills installed together from one repo (`npx skills add`),
+// recorded in .agents/.skill-lock.json → Discover groups them into one 套件.
+const suite = {
+  hyperframes: "Entry skill: route any video request",
+  "hyperframes-core": "The HyperFrames composition contract",
+  "hyperframes-media": "TTS, BGM, SFX and captions",
+  "motion-graphics": "Short design-led motion graphics",
+  "website-to-video": "Capture a website into a video",
+};
+for (const [n, desc] of Object.entries(suite)) {
+  skill(path.join(root, `.claude/skills/${n}`), n, desc);
+  skill(path.join(root, `.codex/skills/${n}`), n, desc);
+}
+fs.writeFileSync(
+  path.join(root, ".agents/.skill-lock.json"),
+  JSON.stringify({
+    version: 3,
+    skills: Object.fromEntries(
+      [...Object.keys(suite), "google-flights"].map((n) => [
+        n,
+        n === "google-flights"
+          ? { source: "skillhq/flight-search", sourceType: "github", sourceUrl: "https://github.com/skillhq/flight-search.git" }
+          : { source: "heygen-com/hyperframes", sourceType: "github", sourceUrl: "https://github.com/heygen-com/hyperframes.git" },
+      ])
+    ),
+  }, null, 2)
+);
+
+// bundled
+skill(path.join(root, ".codex/vendor_imports/skills/codex-builtin"), "codex-builtin", "A bundled Codex skill");
+for (const n of ["pptx", "pdf", "docx"])
+  skill(path.join(root, `.hermes/hermes-agent/skills/${n}`), n, `Hermes bundled: ${n}`);
+dir(path.join(root, ".hermes/skills"));
+fs.writeFileSync(
+  path.join(root, ".hermes/hermes-agent/.bundled_manifest"),
+  JSON.stringify(["pptx", "pdf", "docx"])
+);
+// Real-world Hermes layout: active skills live as real copies under
+// .hermes/skills, with a co-located `name:hash` manifest marking which are
+// bundled. This is what was previously misclassified as "not imported".
+const hermesActive = {
+  airtable: "30f47a4b29827da14e655356c0edd8a7",
+  arxiv: "06b6666b948852e77545c99ef72139db",
+  "ascii-art": "3aea656d9b8fb9d054ce37565e704a04",
+  "baoyu-comic": "8ff68387b01dea27ce049837ae9ecc47",
+  comfyui: "7efa41ae19823ed75a05ce96d9c44e07",
+};
+for (const n of Object.keys(hermesActive))
+  skill(path.join(root, `.hermes/skills/${n}`), n, `Hermes built-in: ${n}`);
+// A genuinely user-authored skill in the same dir, NOT in the manifest →
+// must stay in "not imported", proving we don't over-classify.
+skill(path.join(root, ".hermes/skills/my-custom-thing"), "my-custom-thing", "A skill I wrote myself");
+fs.writeFileSync(
+  path.join(root, ".hermes/skills/.bundled_manifest"),
+  Object.entries(hermesActive).map(([n, h]) => `${n}:${h}`).join("\n") + "\n"
+);
+dir(path.join(root, ".kimi/skills"));
+
+// MCP configs (all formats)
+fs.writeFileSync(
+  path.join(root, ".claude.json"),
+  JSON.stringify({ mcpServers: { notion: { command: "npx", args: ["-y", "@notion/mcp"], env: { NOTION_TOKEN: "secret_abcdefghijklmnop" } }, "chrome-devtools": { command: "chrome-devtools-mcp", args: [], env: {} } } }, null, 2)
+);
+dir(path.join(root, ".gemini"));
+fs.writeFileSync(path.join(root, ".gemini/settings.json"), JSON.stringify({ mcpServers: { filesystem: { command: "mcp-fs", args: ["/tmp"], env: {} } } }, null, 2));
+fs.writeFileSync(path.join(root, ".kimi/mcp.json"), JSON.stringify({ mcpServers: { weather: { command: "weather-mcp", args: [], env: { OPENWEATHER_KEY: "owm_secret_key_123" } } } }, null, 2));
+dir(path.join(root, ".codex"));
+fs.writeFileSync(path.join(root, ".codex/config.toml"), `[mcp_servers.github]\ncommand = "gh-mcp"\nargs = ["--stdio"]\n\n[mcp_servers.github.env]\nGITHUB_TOKEN = "ghp_supersecrettoken123"\n`);
+dir(path.join(root, ".hermes"));
+fs.writeFileSync(path.join(root, ".hermes/config.yaml"), `mcp_servers:\n  slack:\n    command: slack-mcp\n    args: ["--port", "3000"]\n    env:\n      SLACK_BOT_TOKEN: xoxb-1234567890abcdef\n`);
+dir(path.join(root, ".openclaw"));
+fs.writeFileSync(path.join(root, ".openclaw/openclaw.json"), JSON.stringify({ mcporter: { servers: { linear: { command: "linear-mcp", args: [], env: { LINEAR_API_KEY: "lin_api_secretkey" } } } } }, null, 2));
+
+console.log("Sandbox built at", base);
+console.log("  SSM_AGENT_ROOT=" + root);
+console.log("  SSM_DATA_DIR=" + dataDir);

package/scripts/prepare.mjs

@@ -0,0 +1,27 @@
+// npm "prepare" hook: make sure a production build exists.
+// Runs after `npm install` in a dev checkout and when installing straight
+// from git (e.g. `npx github:AliZe198/simple-skill-manager`). Skips when a
+// build is already present so local installs stay fast; `npm publish` always
+// rebuilds via "prepack".
+import { existsSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const pkgRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+if (existsSync(path.join(pkgRoot, ".next", "BUILD_ID"))) process.exit(0);
+
+const require = createRequire(path.join(pkgRoot, "package.json"));
+let nextBin;
+try {
+  nextBin = require.resolve("next/dist/bin/next");
+} catch {
+  // Dependencies not installed yet (e.g. bare checkout) — nothing to do.
+  process.exit(0);
+}
+const r = spawnSync(process.execPath, [nextBin, "build"], {
+  cwd: pkgRoot,
+  stdio: "inherit",
+});
+process.exit(r.status ?? 1);