skillcellar 0.7.0 → 0.8.0

package/README.md

@@ -3,8 +3,8 @@
 Keeps your [SkillCellar](https://skillcellar.com) library's list of what a computer has for Claude Code, globally and in every project: skills, plugins, MCP servers, memory files and agents, by name and hash. It also hands Claude Code the tasks you queue for that computer on the site, applies playbooks, backs the computer up to a private GitHub repository you own, restores another computer's backup, and tells you which of its skills and plugins are outdated. Node 20 or later, no dependencies; `backup` and `restore` need git. Run it with `npx skillcellar <command>`, or install it with `npm install -g skillcellar`.
 
 1. Create an API key at https://skillcellar.com/dashboard/keys, one per computer.
-2. `npx skillcellar login`: paste the key, then choose which of your devices this computer is, or name a new one. `--device <name>` chooses without asking. It then offers to install the skillcellar skill for Claude Code, in `~/.claude/skills/skillcellar`.
-3. `npx skillcellar sync`: reports the whole computer in one request: what it has globally, then every project Claude Code knows, and every clone a restore wrote into. Each sync replaces what the last one reported from this computer, so a project you deleted, or one Claude Code no longer lists, leaves this computer's list on the site, and the site once no computer has anything in it; marks you once made by hand on the site stay. `--project <name>`, run inside a project's folder, reports only that project (every checkout of it Claude Code knows) and global, under that name, and leaves the others as they are. `--dry-run` prints what would be sent and sends nothing. The site then closes the tasks it finds done, and the sync lists them.
+2. `npx skillcellar login`: paste the key, then choose which of your devices this computer is, or name a new one. `--device <name>` chooses without asking. It then offers to install the skillcellar skill for Claude Code, in `~/.claude/skills/skillcellar`, and asks, once, whether to report each project's technologies (see [Technologies](#technologies)).
+3. `npx skillcellar sync`: reports the whole computer in one request: what it has globally, then every project Claude Code knows, and every clone a restore wrote into. Each sync replaces what the last one reported from this computer, so a project you deleted, or one Claude Code no longer lists, leaves this computer's list on the site, and the site once no computer has anything in it; marks you once made by hand on the site stay. `--project <name>`, run inside a project's folder, reports only that project (every checkout of it Claude Code knows) and global, under that name, and leaves the others as they are. `--dry-run` prints what would be sent and sends nothing. The site then closes the tasks it finds done, and the sync lists them. A sync at a terminal asks about technologies if `login` did not.
 
 ## Tasks
 
@@ -27,6 +27,18 @@ Both read this computer as `sync` does and send that list as `sync` sends it (na
 
 `skillcellar check` asks the site which of this computer's skills and plugins their sources have moved past, as the last sync reported them, and prints each with the command that updates it: a skill `npx skills` installed globally, when the git tree of its folder on the repository's default branch is no longer the one its lock recorded (`npx skills update <name> -g`; a skill whose folder is not named as its SKILL.md names it updates with `npx skills update -g`); a plugin, when its marketplace entry declares a version other than the installed one (`claude plugin update <plugin>@<marketplace>`); a skill you wrote or bought, in a folder of its name, when that folder is an older version of it (`skillcellar pull <name> --force`, or `<username>/<name>` for one you bought, with `--scope project` in a project; it replaces the folder with the site's latest version, which is why a folder that is no version of the skill, edited here or another skill of that name, is listed as not checked instead). It then lists what the site cannot check, each with why: a skill `npx skills` installed in a project, whose lock hashes the files, which GitHub does not list; a plugin reported without a version, whose marketplace entry declares none, whose marketplace no longer lists it, or whose marketplace is not on GitHub; a repository that is private, gone or too large to list, or whose folder is no longer at the recorded path; and what the site did not read this time, past its 40 sources or 8 seconds a check or its GitHub budget, which the next check tries again. The site reads each repository and marketplace once an hour, public ones only, with its own GitHub token. `--json` prints the site's answer as it is. Sync first: the check reads what the last sync reported, as its last line says, not the computer as it is now.
 
+## Technologies
+
+At the first `login` or `sync` at a terminal, the CLI asks once whether to report each project's technologies, such as `nextjs` or `postgres`, so the site can show what fits each project. Until you say yes, it reads and sends nothing about them. `skillcellar tech on` and `skillcellar tech off` change the answer; `skillcellar tech` says which it is.
+
+With technologies on, each sync downloads the site's public list at `/tech.json`, without your key, and checks each project where it reports something against it, on this computer:
+
+- the files git tracks in the project (the files at its root, when git tracks none), up to three folders below its root, outside folders such as `node_modules`, `vendor`, `dist` or `examples`. A file in a folder starting with a dot counts only where the list names that folder, such as `.github/workflows`, and a manifest there is never read;
+- at the project's root, the few files the list names there, such as `.neon`, even when git does not track them;
+- the package names in its `package.json`, `composer.json`, `requirements*.txt`, `*-requirements.txt`, `requirements/*.txt`, `pyproject.toml`, `Pipfile`, `go.mod`, `Cargo.toml`, `Gemfile` and `pubspec.yaml` files, up to 40 of them, each at most 1 MiB. It never opens a lockfile, a `.env` file or a file through a link.
+
+Only the ids of the list that match are sent, at most 32 a project. A project whose folder it cannot read, or whose manifests it cannot get through within two seconds, sends none, and the site keeps what it had there. Turned off, each sync takes them back from the site until one of the whole computer has gone through. When the site's list cannot be read, or the technologies would take a sync past its 5,000 items, the sync goes on without them, says so, and the site keeps what it had.
+
 ## Backups
 
 To move to a new computer, or back onto one you reinstall, follow the step-by-step guide at https://skillcellar.com/guides/new-computer.
@@ -64,7 +76,8 @@ For each place, global or a project:
 
 - a skill's or plugin's name, the GitHub repository or marketplace it comes from as an https address, its folder in that repository, and a hash or version;
 - an MCP server's name, its transport (stdio, HTTP or SSE), and for stdio the command's own name, such as `npx`, with the package a runner such as `npx`, `uvx`, `bunx` or `pnpm dlx` starts; for HTTP and SSE, the address's origin and its path up to the first part that is not a short word such as `mcp`, `sse` or `v1`, since some addresses carry a key there. A flag the CLI does not know ends its search for the package, since its value could be a key; a flag written as `--flag=value` is skipped, and its value is never sent. Never its `env` or header values, its other arguments, a query, or a user name and password. WebSocket and SDK servers are left out;
-- a memory file's path from its folder, such as `rules/common/testing.md`, and an agent's name, each with a SHA-256 of the file, never its contents.
+- a memory file's path from its folder, such as `rules/common/testing.md`, and an agent's name, each with a SHA-256 of the file, never its contents;
+- with technologies on, a project's technologies, as ids of the site's list, never a package's name.
 
 The project's name is the one you give with `--project`, else its git remote's `owner/repo`, else its folder's name, and a GitHub remote is also sent as the project's repository; the site keeps the name only as a slug, such as `owner-repo`, and a folder's name as you see it. It sends no path on your computer; a name it cannot send as it is, it lists and leaves out.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillcellar",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Sync what Claude Code has on this computer (skills, plugins, MCP servers, memory and agents) to your SkillCellar library, by name and hash, list the tasks you queue there for Claude Code to carry out, check which skills and plugins are outdated, and apply playbooks.",
   "keywords": [
     "claude-code",

package/src/cli.mjs

@@ -15,6 +15,7 @@ import { checkProjectSkills, installPulled, PULL_REF_RE, readPulled } from "./pu
 import { runRestore } from "./restore.mjs";
 import { readJson, scanGlobal, scanProject } from "./scan.mjs";
 import { installSkill, skillFolder, skillState } from "./skill.mjs";
+import { detectTech, loadRules, techChoice, techServed } from "./tech.mjs";
 
 const DEFAULT_SITE = "https://skillcellar.com";
 const VERSION = JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8")).version;
@@ -63,6 +64,11 @@ Usage:
       missing with how to install it. It reads this computer as sync does, and the site keeps none of it.
   skillcellar skill
       Install or update the skillcellar skill, which tells Claude Code how to carry out your tasks.
+  skillcellar tech [on|off]
+      Turn on or off reporting each project's technologies at sync, such as nextjs or postgres:
+      this computer checks your projects against the site's public list at <site>/tech.json and
+      sends only the ids that match, never a package's name, a file or a path. Off, the next sync
+      of the whole computer removes the ones the site has. Alone, it says which it is.
   skillcellar backup [--repo <owner>/<repo>] [--ssh] [--allow <file>] [--dry-run]
       Push this computer's memory files, rules, agents, MCP config (every env and header value,
       address credential and key-like argument replaced by a \${NAME} placeholder) and skills'
@@ -158,6 +164,16 @@ async function offerSkill(print) {
   else print(`The skillcellar skill is not ${state === "missing" ? "installed" : "up to date"}; run skillcellar skill to ${verb.toLowerCase()} it.`);
 }
 
+/** The one question that turns technologies on: nothing about them leaves this computer before a yes. */
+const techQuestion = (site) =>
+  `Also report each project's technologies, such as nextjs or postgres, so SkillCellar can show what fits each project? This computer checks your projects against the site's public list at ${new URL(site).host}/tech.json and sends only the ids that match, never a package's name, a file or a path. Change it any time with skillcellar tech on or off. [y/N] `;
+
+const askTech = async (site) => /^y(es)?$/i.test(await ask(techQuestion(site)));
+
+/** What turning technologies on or off just did, in one line. */
+const techSaved = (tech, site) =>
+  tech === "on" ? `Technologies on: each sync reports your projects' technologies as ids from ${new URL(site).host}/tech.json.` : "Technologies off: run skillcellar tech on to report them.";
+
 async function login(flags, print) {
   const site = siteOrigin(flags.site ?? process.env.SKILLCELLAR_URL ?? DEFAULT_SITE);
   if (!site) throw new UsageError("--site must be an https address, such as https://skillcellar.com, or http on this computer for development.");
@@ -169,10 +185,19 @@ async function login(flags, print) {
   const earlier = await readConfig().catch(() => null);
   const backup = earlier?.site === site && earlier.backup ? { backup: earlier.backup } : {};
   const folders = Array.isArray(earlier?.folders) ? { folders: earlier.folders } : {};
-  await writeConfig({ site, key, device: { id: device.id, slug: device.slug, name: device.name }, ...backup, ...folders });
+  // So is the answer about technologies, which is this site's to know.
+  const tech = earlier?.site === site && typeof earlier.tech === "string" ? { tech: earlier.tech } : {};
+  const saved = { site, key, device: { id: device.id, slug: device.slug, name: device.name }, ...backup, ...folders, ...tech };
+  await writeConfig(saved);
   const who = library.account?.email ? ` as ${library.account.email}` : "";
   print(`Signed in to ${new URL(site).host}${who}. This computer syncs as ${device.name}.`);
   await offerSkill(print);
+  // Asked here as well: a sync Claude Code runs has no terminal to ask at.
+  if (!tech.tech && interactive()) {
+    const on = (await askTech(site)) ? "on" : "off";
+    await writeConfig({ ...saved, tech: on });
+    print(techSaved(on, site));
+  }
 }
 
 const plural = (n, word, words = `${word}s`) => `${n} ${n === 1 ? word : words}`;
@@ -227,6 +252,21 @@ async function sync(flags, print, warn) {
   // Read from the wrong folder, a sync would report nothing and remove what the last one reported.
   await checkClaudeFolder(claudeDir);
 
+  // Technologies go only after a yes, and only to a site that serves its list: one without it gets
+  // the payload it always had, and keeps what it holds.
+  const choice = await techChoice(config?.tech, Boolean(config) && !dryRun && interactive(), () => askTech(site));
+  if (choice.asked) {
+    await writeConfig({ ...config, tech: choice.tech });
+    print(techSaved(choice.tech, site));
+  }
+  // Taking them back needs no rules, only a site that serves the list, whatever its version.
+  const rules = choice.tech === "on" && site ? await loadRules(site, VERSION) : null;
+  const clearing = choice.tech === "clearing" && site !== null && (await techServed(site, VERSION));
+  if (site && ((choice.tech === "on" && !rules) || (choice.tech === "clearing" && !clearing))) {
+    warn(`Technologies not ${choice.tech === "on" ? "reported" : "removed"} this time: ${new URL(site).host}/tech.json could not be read. The site keeps what it had.`);
+  }
+  const reportTech = rules !== null;
+
   const claudeJson = (await readJson(claudeJsonPath(home))) ?? {};
   const cwd = process.cwd();
   const whole = flags.project === undefined;
@@ -251,8 +291,9 @@ async function sync(flags, print, warn) {
       continue;
     }
     let scanned;
+    const tracked = await trackedFiles(project.root);
     try {
-      scanned = await scanProject({ root: project.root, folders: [...project.folders], claudeDir, claudeJson, tracked: await trackedFiles(project.root) });
+      scanned = await scanProject({ root: project.root, folders: [...project.folders], claudeDir, claudeJson, tracked });
     } catch (error) {
       // One project's broken file stops only that project in a sync of the whole computer.
       if (!whole) throw error;
@@ -261,7 +302,15 @@ async function sync(flags, print, warn) {
       continue;
     }
     skipped.push(...scanned.skipped);
-    const place = { scope: "project", project: { name: project.name, repo: project.repo, remote: project.remote }, items: scanned.items };
+    // The site keeps a project's technologies only where the device reports something, so a place
+    // with nothing lists none; one the CLI could not read lists nothing at all, and keeps what the site had.
+    let tech = {};
+    if (reportTech) {
+      const found = scanned.items.length ? await detectTech(rules, project.root, tracked) : [];
+      if (found) tech = { tech: found };
+      else warn(`Technologies of ${project.name} not read this time. The site keeps what it had there.`);
+    }
+    const place = { scope: "project", project: { name: project.name, repo: project.repo, remote: project.remote }, items: scanned.items, ...tech };
     // A complete sync replaces every place on the device, so a project with nothing in it needs no place.
     if (whole && !scanned.items.length) empty.push(place);
     else places.push(place);
@@ -282,8 +331,15 @@ async function sync(flags, print, warn) {
   }
 
   const device = config?.device.id ?? null;
-  const payload = { device, complete, places: [{ scope: "global", project: null, items: global.items }, ...places] };
-  const items = payload.places.reduce((total, place) => total + place.items.length, 0);
+  const payload = { device, complete, ...(reportTech || clearing ? { tech: reportTech } : {}), places: [{ scope: "global", project: null, items: global.items }, ...places] };
+  // A project's technologies count as items on the site; past the cap with them, the sync goes without.
+  const counted = (withTech) => payload.places.reduce((total, place) => total + place.items.length + (withTech ? (place.tech?.length ?? 0) : 0), 0);
+  let items = counted(true);
+  if (items > ITEMS_PER_SYNC && counted(false) <= ITEMS_PER_SYNC) {
+    payload.places = payload.places.map((place) => Object.fromEntries(Object.entries(place).filter(([key]) => key !== "tech")));
+    items = counted(false);
+    warn(`Technologies not reported this time: with them, this sync passes the ${ITEMS_PER_SYNC} items one sync takes. The site keeps what it had.`);
+  }
   if (items > ITEMS_PER_SYNC) {
     throw new Error(`This computer has ${items} items, and one sync takes ${ITEMS_PER_SYNC}. Sync the projects you need from their folders with --project <name>.`);
   }
@@ -294,6 +350,12 @@ async function sync(flags, print, warn) {
   }
   const result = await call(site, config.key, "POST", "/api/v1/sync", payload, VERSION);
   print(summary(payload, result, config.device.name, whole));
+  if (reportTech && typeof result.tech === "number") print(`Reported the technologies of ${plural(result.tech, "project")}.`);
+  // Taken back everywhere once a sync of the whole computer has gone through.
+  if (clearing && complete) {
+    await writeConfig({ ...config, tech: "off" });
+    print(`Removed this computer's technologies from ${new URL(site).host}.`);
+  }
   for (const note of Array.isArray(result.left) ? result.left : []) warn(`Left out ${note}`);
   const closed = Array.isArray(result.closed) ? result.closed : [];
   if (closed.length) print(closedLine(closed));
@@ -449,6 +511,28 @@ async function restore(flags, print, warn) {
   if (added.length) await writeConfig({ ...config, folders: [...remembered, ...added] });
 }
 
+/**
+ * Turns reporting technologies on or off, or says which it is. Off after they were on, the site
+ * still has them until a sync of the whole computer takes them back ("clearing").
+ */
+async function tech(word, print) {
+  const { config, site } = await signedIn();
+  const host = new URL(site).host;
+  if (word === undefined) {
+    const state = {
+      on: `This computer reports each project's technologies at every sync, as ids from ${host}/tech.json. Run skillcellar tech off to stop.`,
+      clearing: `Technologies are off. The next sync of the whole computer removes this computer's technologies from ${host}.`,
+      off: "This computer does not report its projects' technologies. Run skillcellar tech on to start.",
+    }[config.tech];
+    print(state ?? "Technologies are not reported: you have not been asked yet. A sync at a terminal asks, or run skillcellar tech on.");
+    return;
+  }
+  if (word !== "on" && word !== "off") throw new UsageError("Run tech on or tech off, or tech alone to see which it is.");
+  const next = word === "on" ? "on" : config.tech === "on" || config.tech === "clearing" ? "clearing" : "off";
+  await writeConfig({ ...config, tech: next });
+  print(next === "clearing" ? `Technologies off: the next sync of the whole computer removes this computer's technologies from ${host}.` : techSaved(next, site));
+}
+
 /** Installs or updates the skillcellar skill without asking: the command itself is the yes. */
 async function skill(print) {
   const claudeDir = claudeFolder(homedir());
@@ -515,8 +599,8 @@ export async function main(argv, toOut = console.log, toErr = console.error) {
     return flags.help ? 0 : 2;
   }
   try {
-    // Only pull takes an argument, the skill it installs, and playbook two: what to do, and with which playbook.
-    const [action, ref, ...rest] = command === "playbook" ? extra : command === "pull" ? [undefined, ...extra] : [undefined, undefined, ...extra];
+    // Only pull and tech take an argument, the skill it installs or on or off, and playbook two: what to do, and with which playbook.
+    const [action, ref, ...rest] = command === "playbook" ? extra : command === "pull" || command === "tech" ? [undefined, ...extra] : [undefined, undefined, ...extra];
     if (rest.length) throw new UsageError(`Unexpected ${rest.join(" ")}.`);
     if (command === "login") await login(flags, print);
     else if (command === "sync") await sync(flags, print, warn);
@@ -525,6 +609,7 @@ export async function main(argv, toOut = console.log, toErr = console.error) {
     else if (command === "pull") await pull(flags, ref, print);
     else if (command === "playbook") await playbook(flags, action, ref, print, warn);
     else if (command === "skill") await skill(print);
+    else if (command === "tech") await tech(ref, print);
     else if (command === "backup") await backup(flags, print, warn);
     else if (command === "restore") await restore(flags, print, warn);
     else throw new UsageError(`Unknown command ${command}.`);

package/src/manifests.mjs

@@ -0,0 +1,290 @@
+// Readers for the manifests that list a project's packages. Each takes the file's text and answers
+// the names it lists, never throwing: a file it cannot read lists nothing. The names stay on this
+// computer; only the ids of the technologies they match are sent.
+
+const NAME_MAX = 214;
+// Longer lines are skipped by the line readers: no dependency is written on one, and a pattern run on
+// a long hostile line could take minutes.
+const LINE_MAX = 1000;
+const lines = (text) => text.split(/\r?\n/).filter((line) => line.length <= LINE_MAX);
+
+/**
+ * The registry whose manifest a file is, by its name and its folder's, or null. Lockfiles are never
+ * read. pip's requirements go by many names: requirements.txt, dev-requirements.txt, requirements/base.txt.
+ */
+export function manifestEcosystem(file, folder = "") {
+  if (file === "package.json") return "npm";
+  if (file === "composer.json") return "composer";
+  if (file === "pyproject.toml" || file === "Pipfile" || /^(?:[\w.-]+[-_.])?requirements[\w.-]*\.txt$/.test(file) || (folder === "requirements" && file.endsWith(".txt"))) return "pypi";
+  if (file === "go.mod") return "go";
+  if (file === "Cargo.toml") return "cargo";
+  if (file === "Gemfile") return "gem";
+  if (file === "pubspec.yaml") return "pub";
+  return null;
+}
+
+/** A package name as its registry compares it: PyPI by PEP 503, crates with - for _, and npm, Composer and gems in lowercase. */
+export function normalizeName(ecosystem, name) {
+  if (ecosystem === "pypi") return name.toLowerCase().replace(/[-_.]+/g, "-");
+  if (ecosystem === "cargo") return name.toLowerCase().replace(/_/g, "-");
+  if (ecosystem === "npm" || ecosystem === "composer" || ecosystem === "gem") return name.toLowerCase();
+  return name;
+}
+
+/** The package names a manifest lists, in its order, as written. */
+export function dependencyNames(ecosystem, file, text) {
+  try {
+    const body = text.replace(/^/, "");
+    const names =
+      ecosystem === "npm"
+        ? npmNames(body)
+        : ecosystem === "composer"
+          ? composerNames(body)
+          : ecosystem === "pypi"
+            ? file === "pyproject.toml"
+              ? pyprojectNames(body)
+              : file === "Pipfile"
+                ? pipfileNames(body)
+                : requirementsNames(body)
+            : ecosystem === "go"
+              ? goNames(body)
+              : ecosystem === "cargo"
+                ? cargoNames(body)
+                : ecosystem === "gem"
+                  ? gemNames(body)
+                  : ecosystem === "pub"
+                    ? pubNames(body)
+                    : [];
+    return names.filter((name) => typeof name === "string" && name !== "" && name.length <= NAME_MAX && !/\s/.test(name));
+  } catch {
+    return [];
+  }
+}
+
+const isTable = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+
+function npmNames(text) {
+  const json = JSON.parse(text);
+  if (!isTable(json)) return [];
+  const names = [];
+  for (const list of ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]) {
+    if (!isTable(json[list])) continue;
+    for (const [name, spec] of Object.entries(json[list])) {
+      names.push(name);
+      // "x": "npm:real@1" installs real under the name x.
+      if (typeof spec === "string" && spec.startsWith("npm:")) {
+        const alias = spec.slice(4);
+        const at = alias.indexOf("@", alias.startsWith("@") ? 1 : 0);
+        names.push(at === -1 ? alias : alias.slice(0, at));
+      }
+    }
+  }
+  return names;
+}
+
+function composerNames(text) {
+  const json = JSON.parse(text);
+  if (!isTable(json)) return [];
+  const platform = (name) => name === "php" || name.startsWith("ext-") || name.startsWith("lib-") || name.startsWith("composer-");
+  return ["require", "require-dev"].flatMap((list) => (isTable(json[list]) ? Object.keys(json[list]).filter((name) => !platform(name.toLowerCase())) : []));
+}
+
+/** A requirement's name, as PEP 508 writes one first, or null for anything else: an option, a path or a URL. */
+function requirementName(requirement) {
+  const match = /^([A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?)(?=$|[\s[;=<>!~@,(])/.exec(requirement.trim());
+  return match ? match[1] : null;
+}
+
+function requirementsNames(text) {
+  const names = [];
+  for (const line of lines(text.replace(/\\\r?\n/g, " "))) {
+    const requirement = line.replace(/(^|\s)#.*$/, "").trim();
+    if (!requirement || requirement.startsWith("-")) continue;
+    const name = requirementName(requirement);
+    if (name) names.push(name);
+  }
+  return names;
+}
+
+/** A line of TOML up to a # outside a string. */
+function withoutComment(line) {
+  let quote = null;
+  for (let i = 0; i < line.length; i += 1) {
+    const char = line[i];
+    if (quote) {
+      if (char === "\\" && quote === '"') i += 1;
+      else if (char === quote) quote = null;
+    } else if (char === '"' || char === "'") quote = char;
+    else if (char === "#") return line.slice(0, i);
+  }
+  return line;
+}
+
+/** How deep in brackets and braces, outside strings, a line of a TOML value leaves it, from `depth`. */
+function depthAfter(line, depth) {
+  let quote = null;
+  for (let i = 0; i < line.length; i += 1) {
+    const char = line[i];
+    if (quote) {
+      if (char === "\\" && quote === '"') i += 1;
+      else if (char === quote) quote = null;
+    } else if (char === '"' || char === "'") quote = char;
+    else if (char === "[" || char === "{") depth += 1;
+    else if (char === "]" || char === "}") depth -= 1;
+  }
+  return depth;
+}
+
+/** The strings in a TOML value, leaving out those inside an inline table such as { include-group = "x" }. */
+function valueStrings(value) {
+  const strings = [];
+  let depth = 0;
+  let quote = null;
+  let start = 0;
+  for (let i = 0; i < value.length; i += 1) {
+    const char = value[i];
+    if (quote) {
+      if (char === "\\" && quote === '"') i += 1;
+      else if (char === quote) {
+        if (depth === 0) strings.push(value.slice(start, i));
+        quote = null;
+      }
+    } else if (char === '"' || char === "'") {
+      quote = char;
+      start = i + 1;
+    } else if (char === "{") depth += 1;
+    else if (char === "}") depth -= 1;
+  }
+  return strings;
+}
+
+/** A TOML key's name: a quoted one as it is, a dotted one by its first part. */
+const keyName = (key) => (/^["']/.test(key) ? key.slice(1, -1) : key.split(".")[0].trim());
+
+/**
+ * The tables and key = value lines of a TOML file, as far as the readers here need: each table's
+ * header (key null), then each of its keys with the value's text, an array or inline table spread
+ * over several lines joined.
+ */
+function* tomlEntries(text) {
+  const rows = lines(text);
+  let section = "";
+  for (let i = 0; i < rows.length; i += 1) {
+    const line = withoutComment(rows[i]).trim();
+    if (!line) continue;
+    if (line.startsWith("[")) {
+      const header = /^\[\[?([^\]]+)\]\]?$/.exec(line);
+      section = header ? header[1].trim() : "";
+      if (header) yield { section, key: null, value: "" };
+      continue;
+    }
+    const at = line.indexOf("=");
+    if (at < 1) continue;
+    let value = line.slice(at + 1).trim();
+    // Counted line by line, so a value left open to the end of the file costs one pass over it.
+    let depth = /^[[{]/.test(value) ? depthAfter(value, 0) : 0;
+    while (depth > 0 && i + 1 < rows.length) {
+      i += 1;
+      const next = withoutComment(rows[i]);
+      value += `\n${next}`;
+      depth = depthAfter(next, depth);
+    }
+    yield { section, key: line.slice(0, at).trim(), value };
+  }
+}
+
+const POETRY_RE = /^tool\.poetry\.(?:dependencies|dev-dependencies|group\.[^.]+\.dependencies)$/;
+
+function pyprojectNames(text) {
+  const names = [];
+  for (const { section, key, value } of tomlEntries(text)) {
+    if (key === null) continue;
+    const lists = (section === "project" && keyName(key) === "dependencies") || section === "project.optional-dependencies" || section === "dependency-groups" || (section === "tool.uv" && keyName(key) === "dev-dependencies");
+    if (lists) {
+      // One push per name: spreading a long list into push() passes the engine's limit on arguments.
+      for (const requirement of valueStrings(value)) {
+        const name = requirementName(requirement);
+        if (name) names.push(name);
+      }
+    } else if (POETRY_RE.test(section) && keyName(key).toLowerCase() !== "python") names.push(keyName(key));
+  }
+  return names;
+}
+
+function pipfileNames(text) {
+  return [...tomlEntries(text)].flatMap(({ section, key }) => (key !== null && (section === "packages" || section === "dev-packages") ? [keyName(key)] : []));
+}
+
+const CARGO_TABLE_RE = /^(?:target\..+\.)?(?:dependencies|dev-dependencies|build-dependencies)$|^workspace\.dependencies$/;
+const CARGO_NAMED_RE = /^(?:(?:target\..+\.)?(?:dependencies|dev-dependencies|build-dependencies)|workspace\.dependencies)\.([^.]+)$/;
+
+function cargoNames(text) {
+  const names = [];
+  const quoted = (value) => /^["']([^"']+)["']$/.exec(value.trim())?.[1];
+  for (const { section, key, value } of tomlEntries(text)) {
+    if (CARGO_TABLE_RE.test(section)) {
+      if (key === null) continue;
+      names.push(keyName(key));
+      // db = { package = "rusqlite" } installs rusqlite under the name db.
+      const renamed = value.startsWith("{") ? /\bpackage\s*=\s*["']([^"']+)["']/.exec(value)?.[1] : undefined;
+      if (renamed) names.push(renamed);
+      continue;
+    }
+    const named = CARGO_NAMED_RE.exec(section);
+    if (!named) continue;
+    if (key === null) names.push(keyName(named[1]));
+    else if (keyName(key) === "package" && quoted(value)) names.push(quoted(value));
+  }
+  return names;
+}
+
+function goNames(text) {
+  const names = [];
+  let block = false;
+  for (const raw of lines(text)) {
+    const indirect = /\/\/\s*indirect\b/.test(raw);
+    const line = raw.replace(/\/\/.*$/, "").trim();
+    if (!line) continue;
+    let path = null;
+    if (block) {
+      if (line === ")") {
+        block = false;
+        continue;
+      }
+      path = line.split(/\s+/)[0];
+    } else if (/^require\s*\($/.test(line)) {
+      block = true;
+      continue;
+    } else {
+      path = /^require\s+(\S+)/.exec(line)?.[1] ?? null;
+    }
+    // A module's major version past 1 ends its path: github.com/jackc/pgx/v5.
+    if (path && !indirect) names.push(path.replace(/^"|"$/g, "").replace(/\/v\d+$/, ""));
+  }
+  return names;
+}
+
+function gemNames(text) {
+  return lines(text).flatMap((line) => /^gem[\s(]+["']([^"']+)["']/.exec(line.trimStart())?.[1] ?? []);
+}
+
+function pubNames(text) {
+  const names = [];
+  let section = false;
+  let indent = null;
+  for (const raw of lines(text)) {
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const lead = raw.length - raw.trimStart().length;
+    if (lead === 0) {
+      section = /^(?:dependencies|dev_dependencies)\s*:/.test(raw);
+      indent = null;
+      continue;
+    }
+    if (!section) continue;
+    indent ??= lead;
+    const name = lead === indent ? /^([A-Za-z0-9_]+)\s*:/.exec(trimmed)?.[1] : undefined;
+    if (name) names.push(name);
+  }
+  return names;
+}

package/src/tech.mjs

@@ -0,0 +1,242 @@
+import { lstat, open, readdir, realpath } from "node:fs/promises";
+import { dirname, join, sep } from "node:path";
+import { dependencyNames, manifestEcosystem, normalizeName } from "./manifests.mjs";
+
+// Finds a project's technologies on this computer. The rules come from the site's public list at
+// /tech.json; they are names and paths compared by prefix and suffix, never a pattern the code
+// compiles, and only the ids they match leave the computer.
+
+export const RULES_BYTES_MAX = 512 * 1024;
+const RULES_VERSION = 1;
+const ECOSYSTEMS = ["npm", "pypi", "go", "cargo", "gem", "composer", "pub"];
+const ID_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const ID_MAX = 32;
+// The site's SYNC_TECH_MAX: the most one project reports.
+const PER_PROJECT_MAX = 32;
+const RULES_MAX = 500;
+const PATTERNS_MAX = 200;
+const PATTERN_MAX = 214;
+const SEGMENTS_MAX = 3;
+// A path counts up to this many segments deep: the manifests and markers that say what a project is sit near its root.
+const PATH_SEGMENTS_MAX = 4;
+const MANIFESTS_MAX = 40;
+const MANIFEST_BYTES_MAX = 1024 * 1024;
+const PROJECT_MS_MAX = 2000;
+// Never counted, whatever the list says.
+const ALWAYS_IGNORED = ["node_modules", ".git"];
+
+/** Whether a rule's name or path is one this code compares safely: one `*` at most, no `..`, no backslash, no control character. */
+const usable = (value) => typeof value === "string" && value !== "" && value.length <= PATTERN_MAX && value.split("*").length <= 2 && !value.includes("..") && !/[\\\s\p{Cc}]/u.test(value);
+
+/** A package name or a prefix of one ending in `*`, normalised as its registry compares names. */
+function namePattern(ecosystem, name) {
+  if (!usable(name)) return null;
+  const star = name.endsWith("*");
+  if (name.includes("*") && !star) return null;
+  const prefix = normalizeName(ecosystem, star ? name.slice(0, -1) : name);
+  return prefix ? { prefix, star } : null;
+}
+
+/** A path of 1 to 3 segments, tied to the project's root when it starts with `/`, a segment holding at most one `*`. */
+function filePattern(path) {
+  if (!usable(path)) return null;
+  const anchored = path.startsWith("/");
+  const segments = (anchored ? path.slice(1) : path).split("/");
+  if (segments.length > SEGMENTS_MAX || segments.some((segment) => segment === "" || segment === ".")) return null;
+  return {
+    anchored,
+    segments: segments.map((segment) => {
+      const at = segment.indexOf("*");
+      return at === -1 ? { literal: segment } : { prefix: segment.slice(0, at), suffix: segment.slice(at + 1) };
+    }),
+  };
+}
+
+/**
+ * The list the site serves, as rules this code can use, or null for a list of another version.
+ * It comes from the network, so every field is checked, and a rule it cannot read is left out.
+ */
+export function readRules(json) {
+  if (json?.version !== RULES_VERSION || !Array.isArray(json.tech)) return null;
+  const listed = Array.isArray(json.ignore) ? json.ignore.filter((name) => typeof name === "string" && name !== "" && name.length <= 64 && !name.includes("/")) : [];
+  const ignore = new Set([...ALWAYS_IGNORED, ...listed.slice(0, PATTERNS_MAX)]);
+  const tech = [];
+  const seen = new Set();
+  for (const entry of json.tech.slice(0, RULES_MAX)) {
+    if (typeof entry?.id !== "string" || entry.id.length > ID_MAX || !ID_RE.test(entry.id) || seen.has(entry.id)) continue;
+    const deps = {};
+    for (const ecosystem of ECOSYSTEMS) {
+      const names = Array.isArray(entry.deps?.[ecosystem]) ? entry.deps[ecosystem].slice(0, PATTERNS_MAX) : [];
+      const patterns = names.flatMap((name) => namePattern(ecosystem, name) ?? []);
+      if (patterns.length) deps[ecosystem] = patterns;
+    }
+    const files = (Array.isArray(entry.files) ? entry.files.slice(0, PATTERNS_MAX) : []).flatMap((path) => filePattern(path) ?? []);
+    if (!files.length && !Object.keys(deps).length) continue;
+    seen.add(entry.id);
+    tech.push({ id: entry.id, deps, files });
+  }
+  return { ignore, tech };
+}
+
+/**
+ * The site's list of technologies, downloaded without the key and never through a redirect, or
+ * null when it cannot be had: missing, moved, too large, not JSON, too slow or of another version.
+ */
+export async function loadRules(site, version, { timeout = 10_000 } = {}) {
+  try {
+    const response = await fetch(new URL("/tech.json", site), {
+      headers: { accept: "application/json", "user-agent": `skillcellar/${version}` },
+      redirect: "error",
+      signal: AbortSignal.timeout(timeout),
+    });
+    if (!response.ok || !response.body) return null;
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of response.body) {
+      size += chunk.length;
+      if (size > RULES_BYTES_MAX) return null;
+      chunks.push(chunk);
+    }
+    return readRules(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Whether the site serves /tech.json at all, whatever the list's version: it then takes `tech: false`,
+ * which needs no rules. A site without it, from before 0.8.0's server, would refuse the key.
+ */
+export async function techServed(site, version, { timeout = 10_000 } = {}) {
+  try {
+    const response = await fetch(new URL("/tech.json", site), {
+      headers: { accept: "application/json", "user-agent": `skillcellar/${version}` },
+      redirect: "error",
+      signal: AbortSignal.timeout(timeout),
+    });
+    await response.body?.cancel();
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Whether this computer reports technologies: what the config says, or the answer to the one
+ * question, asked only where it can be. `asked` says the answer is new, for the config to keep.
+ */
+export async function techChoice(saved, canAsk, askYes) {
+  if (saved === "on" || saved === "off" || saved === "clearing") return { tech: saved, asked: false };
+  if (!canAsk) return { tech: null, asked: false };
+  return { tech: (await askYes()) ? "on" : "off", asked: true };
+}
+
+/** A folder or file name a pattern's segment matches; a name starting with a dot only where the rule names the dot. */
+function segmentMatches(pattern, segment) {
+  const named = pattern.literal ?? pattern.prefix;
+  if (segment.startsWith(".") && !named.startsWith(".")) return false;
+  if (pattern.literal !== undefined) return segment === pattern.literal;
+  return segment.length >= pattern.prefix.length + pattern.suffix.length && segment.startsWith(pattern.prefix) && segment.endsWith(pattern.suffix);
+}
+
+/** Whether a path, as its segments, is one a file rule names: the whole path for a rule tied to the root, else its end, with no dot folder before it. */
+function pathMatches(pattern, path) {
+  const count = pattern.segments.length;
+  if (pattern.anchored ? path.length !== count : path.length < count) return false;
+  const tail = path.slice(-count);
+  if (!pattern.anchored && path.slice(0, -count).some((segment) => segment.startsWith("."))) return false;
+  return pattern.segments.every((segment, index) => segmentMatches(segment, tail[index]));
+}
+
+const nameMatches = (pattern, name) => (pattern.star ? name.startsWith(pattern.prefix) : name === pattern.prefix);
+
+/** The project's files as segments, from the list git tracks, or the root's own files when it lists none. */
+async function projectPaths(root, tracked, ignore) {
+  let listed = tracked?.size ? [...tracked] : [];
+  if (!listed.length) {
+    const entries = await readdir(root, { withFileTypes: true }).catch(() => []);
+    listed = entries.filter((entry) => entry.isFile()).map((entry) => entry.name);
+  }
+  return listed.map((path) => path.split("/")).filter((path) => path.length <= PATH_SEGMENTS_MAX && path.every((segment) => segment !== "" && !ignore.has(segment)));
+}
+
+/** Whether a path, its links resolved, is the project's folder or inside it: a linked parent folder can point anywhere. */
+async function inside(base, path) {
+  const real = await realpath(path).catch(() => null);
+  return real !== null && (real === base || real.startsWith(base + sep));
+}
+
+/** A file or folder at the root, which git may not track, such as .neon; a link is not followed. */
+async function isThere(base, path) {
+  const found = await lstat(path).catch(() => null);
+  return Boolean(found && (found.isFile() || found.isDirectory()) && (await inside(base, dirname(path))));
+}
+
+/** A manifest's text, or null when it is missing, a link or under one, not a plain file, or over 1 MiB. */
+async function readManifest(base, path) {
+  const found = await lstat(path).catch(() => null);
+  if (!found?.isFile() || found.size > MANIFEST_BYTES_MAX || !(await inside(base, path))) return null;
+  let handle;
+  try {
+    handle = await open(path, "r");
+    const opened = await handle.stat();
+    if (!opened.isFile() || opened.size > MANIFEST_BYTES_MAX) return null;
+    return await handle.readFile("utf8");
+  } catch {
+    return null;
+  } finally {
+    await handle?.close().catch(() => {});
+  }
+}
+
+/**
+ * The ids of the technologies a project uses, as the rules find them in its files and manifests,
+ * in the rules' order, at most 32. Nothing it reads leaves this function but those ids, and it
+ * never throws. Null when it could not tell, because a read failed or took past its time: the
+ * sync then sends nothing for the project, and the site keeps what it had, rather than fewer ids.
+ */
+export async function detectTech(rules, root, tracked) {
+  try {
+    const started = Date.now();
+    const base = await realpath(root);
+    const paths = await projectPaths(root, tracked, rules.ignore);
+    const found = new Set();
+    for (const rule of rules.tech) {
+      if (rule.files.some((pattern) => paths.some((path) => pathMatches(pattern, path)))) found.add(rule.id);
+    }
+    // A file the rule ties to the root by its whole name is looked for on disk too: .neon and .vercel are rarely tracked.
+    for (const rule of rules.tech) {
+      if (found.has(rule.id)) continue;
+      for (const pattern of rule.files) {
+        if (pattern.anchored && pattern.segments.every((segment) => segment.literal !== undefined) && (await isThere(base, join(root, ...pattern.segments.map((segment) => segment.literal))))) {
+          found.add(rule.id);
+          break;
+        }
+      }
+    }
+
+    const wanted = new Set(rules.tech.flatMap((rule) => Object.keys(rule.deps)));
+    // A manifest in a dot folder belongs to a tool, such as a skill in .claude or a dev container, not the project.
+    const ecosystemOf = (path) => (path.slice(0, -1).some((segment) => segment.startsWith(".")) ? null : manifestEcosystem(path.at(-1), path.at(-2)));
+    const manifests = paths
+      .filter((path) => wanted.has(ecosystemOf(path)))
+      .sort((a, b) => a.length - b.length || (a.join("/") < b.join("/") ? -1 : 1))
+      .slice(0, MANIFESTS_MAX);
+    const names = new Map(ECOSYSTEMS.map((ecosystem) => [ecosystem, new Set()]));
+    for (const path of manifests) {
+      if (Date.now() - started > PROJECT_MS_MAX) return null;
+      const ecosystem = ecosystemOf(path);
+      const text = await readManifest(base, join(root, ...path));
+      if (text === null) continue;
+      for (const name of dependencyNames(ecosystem, path.at(-1), text)) names.get(ecosystem).add(normalizeName(ecosystem, name));
+    }
+    for (const rule of rules.tech) {
+      if (found.has(rule.id)) continue;
+      const uses = Object.entries(rule.deps).some(([ecosystem, patterns]) => [...names.get(ecosystem)].some((name) => patterns.some((pattern) => nameMatches(pattern, name))));
+      if (uses) found.add(rule.id);
+    }
+    return rules.tech.filter((rule) => found.has(rule.id)).map((rule) => rule.id).slice(0, PER_PROJECT_MAX);
+  } catch {
+    return null;
+  }
+}