skillmds 0.1.0 → 1.0.0

package/dist/cli.js

@@ -0,0 +1,933 @@
+// ../cli/src/index.ts
+import { Command as Command12 } from "commander";
+
+// ../cli/src/commands/lint.ts
+import { Command } from "commander";
+import { writeFileSync } from "fs";
+
+// ../../packages/core/src/parse.ts
+import { parse as parseYaml } from "yaml";
+var MAX_SKILL_BYTES = 256 * 1024;
+var MAX_DESCRIPTION = 500;
+var MAX_NAME = 120;
+var slugify = (s) => String(s).toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "skill";
+function parseSkillMd(raw, type = "single") {
+  if (!raw || raw.length > MAX_SKILL_BYTES) return { error: "SKILL.md missing or too large (max 256KB)" };
+  const m = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
+  if (!m) return { error: "Missing YAML frontmatter (--- ... ---)" };
+  let fm;
+  try {
+    fm = parseYaml(m[1] ?? "") ?? {};
+  } catch {
+    return { error: "Invalid YAML frontmatter" };
+  }
+  const name = String(fm.name ?? "").trim();
+  const description = String(fm.description ?? "").replace(/\s+/g, " ").trim();
+  if (!name) return { error: "frontmatter 'name' is required" };
+  if (!description) return { error: "frontmatter 'description' is required" };
+  if (description.length > MAX_DESCRIPTION) return { error: "description must be <= 500 chars" };
+  return {
+    name: name.slice(0, MAX_NAME),
+    description: description.slice(0, MAX_DESCRIPTION),
+    license: fm.license ? String(fm.license).slice(0, 64) : null,
+    body: m[2] ?? "",
+    type
+  };
+}
+
+// ../../packages/core/src/security.ts
+var RULES = [
+  ["executes_scripts", /```(?:sh|bash|python|py|js|ts|ruby|rb)\b|\b(subprocess|os\.system|child_process|exec\()/i],
+  ["network_calls", /\b(fetch|requests\.|urllib|axios|curl|wget|https?:\/\/|websocket)\b/i],
+  ["reads_secrets", /\b(api[_-]?key|secret|token|password|os\.environ|process\.env|getenv)\b/i]
+];
+function scanSecurity(body) {
+  const findings = [];
+  body.split(/\r?\n/).forEach((text2, i) => {
+    for (const [flag, re] of RULES) {
+      if (re.test(text2)) findings.push({ flag, line: i + 1, snippet: text2.trim().slice(0, 120) });
+    }
+  });
+  const flags = [...new Set(findings.map((f) => f.flag))];
+  return { flags: flags.length ? flags : ["docs_only"], findings };
+}
+
+// ../../packages/core/src/rules.ts
+function utf8Bytes(s) {
+  let bytes = 0;
+  for (let i = 0; i < s.length; i++) {
+    const c = s.charCodeAt(i);
+    if (c < 128) bytes += 1;
+    else if (c < 2048) bytes += 2;
+    else if (c >= 55296 && c <= 56319) {
+      bytes += 4;
+      i++;
+    } else bytes += 3;
+  }
+  return bytes;
+}
+var diag = (rule, message, line) => ({
+  id: rule.id,
+  severity: rule.severity,
+  message,
+  ...line !== void 0 ? { line } : {}
+});
+var RULES2 = [
+  {
+    id: "SK002",
+    severity: "error",
+    description: "name must be present and \u2264 120 chars",
+    check(s, _ctx) {
+      const out = [];
+      if (!s.name.trim()) out.push(diag(this, "frontmatter 'name' is required"));
+      else if (s.name.length > MAX_NAME) out.push(diag(this, `name must be \u2264 ${MAX_NAME} chars`));
+      return out;
+    }
+  },
+  {
+    id: "SK003",
+    severity: "error",
+    description: "description must be present and \u2264 500 chars",
+    check(s, _ctx) {
+      const out = [];
+      if (!s.description.trim()) out.push(diag(this, "frontmatter 'description' is required"));
+      else if (s.description.length > MAX_DESCRIPTION) out.push(diag(this, `description must be \u2264 ${MAX_DESCRIPTION} chars`));
+      return out;
+    }
+  },
+  {
+    id: "SK010",
+    severity: "warn",
+    description: "description should be \u2265 20 chars (not too terse)",
+    check(s, _ctx) {
+      return s.description.trim().length > 0 && s.description.trim().length < 20 ? [diag(this, "description is very terse (< 20 chars); add more detail to help discovery")] : [];
+    }
+  },
+  {
+    id: "SK011",
+    severity: "warn",
+    description: "license should be declared in frontmatter",
+    check(s, _ctx) {
+      return s.license ? [] : [diag(this, "no 'license' declared in frontmatter")];
+    }
+  },
+  {
+    id: "SK020",
+    severity: "warn",
+    description: "body should be \u2265 200 chars (not a stub)",
+    check(s, _ctx) {
+      return s.body.trim().length < 200 ? [diag(this, "body is very short (< 200 chars); this looks like a stub")] : [];
+    }
+  },
+  {
+    id: "SK021",
+    severity: "warn",
+    description: "body should contain at least one Markdown heading",
+    check(s, _ctx) {
+      return /^#{1,6}\s/m.test(s.body) ? [] : [diag(this, "body has no Markdown headings; add structure with '#' headings")];
+    }
+  },
+  {
+    id: "SK030",
+    severity: "error",
+    description: "total SKILL.md size must be \u2264 256KB",
+    check(s, _ctx) {
+      return utf8Bytes(s.body) > MAX_SKILL_BYTES ? [diag(this, "SKILL.md exceeds 256KB")] : [];
+    }
+  },
+  {
+    id: "SK040",
+    severity: "warn",
+    description: "name should match its directory/slug",
+    check(s, ctx) {
+      if (!ctx.slug) return [];
+      const expected = slugify(s.name);
+      return expected === ctx.slug ? [] : [diag(this, `name slug '${expected}' does not match directory '${ctx.slug}'`)];
+    }
+  }
+];
+function runRules(skill, ctx = {}) {
+  return RULES2.flatMap((r) => r.check(skill, ctx));
+}
+
+// ../../packages/core/src/quality.ts
+var WEIGHT = {
+  error: 25,
+  warn: 8,
+  info: 2
+};
+function qualityScore(diagnostics) {
+  const penalty = diagnostics.reduce((sum, d) => sum + WEIGHT[d.severity], 0);
+  return Math.max(0, Math.min(100, 100 - penalty));
+}
+
+// ../../packages/core/src/lint.ts
+function lint(raw, opts = {}) {
+  const parsed = parseSkillMd(raw, opts.type ?? "single");
+  if ("error" in parsed) {
+    const diagnostics2 = [{ id: "SK001", severity: "error", message: parsed.error }];
+    return {
+      ok: false,
+      diagnostics: diagnostics2,
+      security: scanSecurity(raw),
+      score: qualityScore(diagnostics2)
+    };
+  }
+  const ctx = opts.slug !== void 0 ? { slug: opts.slug } : {};
+  const diagnostics = runRules(parsed, ctx);
+  const security = scanSecurity(parsed.body);
+  const ok = !diagnostics.some((d) => d.severity === "error");
+  return { ok, skill: parsed, diagnostics, security, score: qualityScore(diagnostics) };
+}
+
+// ../../packages/core/src/format/text.ts
+var BADGE = { error: "ERROR", warn: " WARN", info: " INFO" };
+function toText(results, opts = {}) {
+  const paint = opts.decorate ?? ((t) => t);
+  const out = [];
+  for (const { file, result } of results) {
+    const status = result.ok ? paint("PASS", "ok") : paint("FAIL", "error");
+    out.push(`${status}  ${file}  ${paint(`score ${result.score}/100`, "dim")}`);
+    for (const d of result.diagnostics) {
+      const where = d.line !== void 0 ? `:${d.line}` : "";
+      out.push(`  ${paint(BADGE[d.severity], d.severity)}  ${d.id}${where}  ${d.message}`);
+    }
+    if (result.security.flags.length && result.security.flags[0] !== "docs_only") {
+      out.push(`  ${paint("SEC ", "warn")}  flags: ${result.security.flags.join(", ")}`);
+    }
+    out.push("");
+  }
+  const failed = results.filter((r) => !r.result.ok).length;
+  const summary = failed === 0 ? paint(`\u2713 ${results.length} skill(s) passed`, "ok") : paint(`\u2717 ${failed}/${results.length} skill(s) failed`, "error");
+  out.push(summary);
+  return out.join("\n");
+}
+
+// ../../packages/core/src/format/json.ts
+function toJson(results) {
+  return results.map(({ file, result }) => ({
+    file,
+    ok: result.ok,
+    score: result.score,
+    diagnostics: result.diagnostics,
+    security: result.security
+  }));
+}
+
+// ../../packages/core/src/format/sarif.ts
+var SARIF_LEVEL = { error: "error", warn: "warning", info: "note" };
+function toSarif(results) {
+  const sarifResults = results.flatMap(
+    ({ file, result }) => result.diagnostics.map((d) => ({
+      ruleId: d.id,
+      level: SARIF_LEVEL[d.severity] ?? "note",
+      message: { text: d.message },
+      locations: [
+        {
+          physicalLocation: {
+            artifactLocation: { uri: file },
+            region: { startLine: d.line ?? 1 }
+          }
+        }
+      ]
+    }))
+  );
+  return {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "skillmd",
+            informationUri: "https://skillmd.com",
+            rules: RULES2.map((r) => ({
+              id: r.id,
+              shortDescription: { text: r.description },
+              defaultConfiguration: { level: SARIF_LEVEL[r.severity] ?? "note" }
+            }))
+          }
+        },
+        results: sarifResults
+      }
+    ]
+  };
+}
+
+// ../../packages/core/src/format/github.ts
+var LEVEL = { error: "error", warn: "warning", info: "notice" };
+function toGithub(results) {
+  const lines = [];
+  for (const { file, result } of results) {
+    for (const d of result.diagnostics) {
+      const level = LEVEL[d.severity] ?? "notice";
+      const loc = d.line !== void 0 ? `,line=${d.line}` : "";
+      lines.push(`::${level} file=${file}${loc},title=${d.id}::${d.message}`);
+    }
+  }
+  return lines.join("\n");
+}
+
+// ../cli/src/source.ts
+import { existsSync, statSync, readFileSync, readdirSync, mkdtempSync } from "fs";
+import { tmpdir } from "os";
+import { join, basename, dirname } from "path";
+var IGNORE_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", ".wrangler"]);
+function findSkillFiles(dir) {
+  const out = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isDirectory()) {
+      if (IGNORE_DIRS.has(entry.name)) continue;
+      out.push(...findSkillFiles(join(dir, entry.name)));
+    } else if (entry.name === "SKILL.md") {
+      out.push(join(dir, entry.name));
+    }
+  }
+  return out;
+}
+function loadLocal(file) {
+  return { path: file, raw: readFileSync(file, "utf8"), slug: basename(dirname(file)), file };
+}
+function isLikelyLocal(arg) {
+  return arg === "." || arg.startsWith("./") || arg.startsWith("../") || arg.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(arg) || existsSync(arg);
+}
+async function resolveSource(arg) {
+  if (isLikelyLocal(arg)) {
+    if (!existsSync(arg)) throw new Error(`Path not found: ${arg}`);
+    const st = statSync(arg);
+    if (st.isFile()) return [loadLocal(arg)];
+    const files2 = findSkillFiles(arg);
+    if (files2.length === 0) throw new Error(`No SKILL.md found under ${arg}`);
+    return files2.map(loadLocal);
+  }
+  const { downloadTemplate } = await import("giget");
+  const input = normalizeGiget(arg);
+  const dir = mkdtempSync(join(tmpdir(), "skillmd-src-"));
+  const { dir: out } = await downloadTemplate(input, { dir, forceClean: true });
+  const files = findSkillFiles(out);
+  if (files.length === 0) throw new Error(`No SKILL.md found in ${arg}`);
+  return files.map(loadLocal);
+}
+function normalizeGiget(arg) {
+  const m = arg.match(/github\.com\/([^/]+)\/([^/]+)(?:\/tree\/[^/]+\/(.+))?/);
+  if (m) return `github:${m[1]}/${m[2]}${m[3] ? "/" + m[3] : ""}`;
+  if (arg.startsWith("github:") || arg.startsWith("gh:")) return arg;
+  return `github:${arg}`;
+}
+
+// ../cli/src/ui.ts
+import pc from "picocolors";
+var decorate = (text2, kind) => {
+  switch (kind) {
+    case "error":
+      return pc.red(text2);
+    case "warn":
+      return pc.yellow(text2);
+    case "info":
+      return pc.cyan(text2);
+    case "ok":
+      return pc.green(text2);
+    case "dim":
+      return pc.dim(text2);
+  }
+};
+function exitCodeFor(results, policy = {}) {
+  for (const { result } of results) {
+    const hasError = result.diagnostics.some((d) => d.severity === "error");
+    const hasWarn = result.diagnostics.some((d) => d.severity === "warn");
+    if (hasError) return 1;
+    if ((policy.strict || policy.failOnWarning) && hasWarn) return 1;
+  }
+  return 0;
+}
+
+// ../cli/src/commands/lint.ts
+function applyLicenseFix(raw) {
+  if (/^---[\s\S]*?\blicense:\s*\S+[\s\S]*?^---/m.test(raw)) return null;
+  const m = raw.match(/^(---\r?\n)([\s\S]*?)(\r?\n---)/);
+  if (!m) return null;
+  return `${m[1]}${m[2]}
+license: UNKNOWN${m[3]}${raw.slice(m[0].length)}`;
+}
+async function runLint(target, flags) {
+  let resolved = await resolveSource(target);
+  if (flags.fix) {
+    resolved = resolved.map((r) => {
+      if (!r.file) return r;
+      const fixed = applyLicenseFix(r.raw);
+      if (fixed) {
+        writeFileSync(r.file, fixed, "utf8");
+        return { ...r, raw: fixed };
+      }
+      return r;
+    });
+  }
+  const results = resolved.map((r) => ({ file: r.path, result: lint(r.raw, { slug: r.slug }), resolved: r }));
+  const exitCode = exitCodeFor(results, flags);
+  let output;
+  switch (flags.format) {
+    case "json":
+      output = JSON.stringify(toJson(results), null, 2);
+      break;
+    case "sarif":
+      output = JSON.stringify(toSarif(results), null, 2);
+      break;
+    case "github":
+      output = toGithub(results);
+      break;
+    default:
+      output = toText(results, { decorate });
+  }
+  return { results, output, exitCode };
+}
+function lintCommand() {
+  return new Command("lint").alias("check").description("Validate SKILL.md file(s) against the spec and report a quality score").argument("[target]", "local path or GitHub source", ".").option("--format <fmt>", "text | json | sarif | github", "text").option("--strict", "treat warnings as errors").option("--fail-on-warning", "exit non-zero when warnings exist").option("--fix", "apply safe automatic fixes (e.g. add missing license)").action(async (target, opts) => {
+    const run = await runLint(target, opts);
+    console.log(run.output);
+    process.exitCode = run.exitCode;
+  });
+}
+
+// ../cli/src/commands/scan.ts
+import { Command as Command2 } from "commander";
+import pc2 from "picocolors";
+async function runScan(target, flags) {
+  const resolved = await resolveSource(target);
+  const deny = new Set(flags.deny ?? []);
+  const entries = resolved.map((r) => {
+    const parsed = parseSkillMd(r.raw, "single");
+    const body = "error" in parsed ? r.raw : parsed.body;
+    const security = scanSecurity(body);
+    const denied = security.flags.filter((f) => deny.has(f));
+    return { file: r.path, security, denied };
+  });
+  const exitCode = entries.some((e) => e.denied.length > 0) ? 1 : 0;
+  let output;
+  if (flags.format === "json") {
+    output = JSON.stringify(entries, null, 2);
+  } else {
+    const lines = [];
+    for (const e of entries) {
+      const flagStr = e.security.flags.join(", ");
+      const head = e.denied.length ? pc2.red(`DENY ${e.file}`) : pc2.green(`OK   ${e.file}`);
+      lines.push(`${head}  ${pc2.dim(flagStr)}`);
+      for (const f of e.security.findings) {
+        const mark = deny.has(f.flag) ? pc2.red(f.flag) : pc2.yellow(f.flag);
+        lines.push(`  ${mark}  :${f.line}  ${pc2.dim(f.snippet)}`);
+      }
+    }
+    output = lines.join("\n");
+  }
+  return { entries, exitCode, output };
+}
+function scanCommand() {
+  return new Command2("scan").description("Security-scan SKILL.md file(s) for scripts, network calls and secret access").argument("[target]", "local path or GitHub source", ".").option("--deny <flags...>", "exit non-zero if any of these flags are present (e.g. executes_scripts)").option("--format <fmt>", "text | json", "text").action(async (target, opts) => {
+    const run = await runScan(target, opts);
+    console.log(run.output);
+    process.exitCode = run.exitCode;
+  });
+}
+
+// ../cli/src/commands/rules.ts
+import { Command as Command3 } from "commander";
+import pc3 from "picocolors";
+function rulesCommand() {
+  return new Command3("rules").description("List lint rules, or show detail for one rule id").argument("[id]", "a rule id, e.g. SK010").option("--json", "machine-readable output").action((id, opts) => {
+    const list = id ? RULES2.filter((r) => r.id.toLowerCase() === id.toLowerCase()) : RULES2;
+    if (id && list.length === 0) {
+      console.error(`Unknown rule: ${id}`);
+      process.exitCode = 1;
+      return;
+    }
+    if (opts.json) {
+      console.log(JSON.stringify(list.map((r) => ({ id: r.id, severity: r.severity, description: r.description })), null, 2));
+      return;
+    }
+    const color = (sev) => (sev === "error" ? pc3.red : sev === "warn" ? pc3.yellow : pc3.cyan)(sev.padEnd(5));
+    for (const r of list) console.log(`${pc3.bold(r.id)}  ${color(r.severity)}  ${r.description}`);
+  });
+}
+
+// ../cli/src/commands/init.ts
+import { Command as Command4 } from "commander";
+import { mkdirSync, writeFileSync as writeFileSync2, existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+import * as p from "@clack/prompts";
+function skillTemplate(name, description, license) {
+  const desc = description.trim() || `A skill that helps agents with ${name}.`;
+  return `---
+name: ${name}
+description: ${desc}
+license: ${license}
+---
+
+# ${name}
+
+## When to use this skill
+
+Describe the situations where an agent should reach for this skill. Be specific
+about the task, the inputs it expects, and the outcome it produces.
+
+## Instructions
+
+1. First step the agent should take.
+2. Second step, with any commands or file paths it needs.
+3. How to verify the result.
+
+## Notes
+
+Add any constraints, edge cases, or references the agent should keep in mind.
+`;
+}
+function initSkill(name, opts = {}) {
+  const slug = slugify(name);
+  const root = join2(opts.dir ?? process.cwd(), slug);
+  if (existsSync2(join2(root, "SKILL.md"))) throw new Error(`SKILL.md already exists at ${root}`);
+  mkdirSync(root, { recursive: true });
+  const file = join2(root, "SKILL.md");
+  writeFileSync2(file, skillTemplate(name, opts.description ?? "", opts.license ?? "MIT"), "utf8");
+  return file;
+}
+function initCommand() {
+  return new Command4("init").description("Scaffold a new SKILL.md from a template").argument("[name]", "skill name").option("--name <name>", "skill name (non-interactive)").option("--description <text>", "skill description").option("--license <license>", "license identifier", "MIT").option("-y, --yes", "skip prompts").action(async (nameArg, opts) => {
+    let name = nameArg ?? opts.name;
+    if (!name && !opts.yes) {
+      const answer = await p.text({ message: "Skill name?", placeholder: "my-skill" });
+      if (p.isCancel(answer)) {
+        p.cancel("Cancelled.");
+        return;
+      }
+      name = answer;
+    }
+    if (!name) {
+      console.error("A skill name is required (pass a name or --name).");
+      process.exitCode = 1;
+      return;
+    }
+    const file = initSkill(name, { description: opts.description, license: opts.license });
+    console.log(`Created ${file}`);
+  });
+}
+
+// ../cli/src/commands/search.ts
+import { Command as Command5 } from "commander";
+import pc4 from "picocolors";
+
+// ../cli/src/config.ts
+import { readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2 } from "fs";
+import { homedir } from "os";
+import { join as join3 } from "path";
+var DEFAULT_API = "https://skillmd-api.vinoor.workers.dev";
+function configPath() {
+  return join3(homedir(), ".skillmd", "config.json");
+}
+function readConfig() {
+  try {
+    return JSON.parse(readFileSync2(configPath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeConfig(cfg) {
+  const dir = join3(homedir(), ".skillmd");
+  mkdirSync2(dir, { recursive: true });
+  writeFileSync3(configPath(), JSON.stringify(cfg, null, 2), { encoding: "utf8", mode: 384 });
+}
+function resolveToken(flags = {}) {
+  return flags.token || process.env.SKILLMD_TOKEN || readConfig().token || void 0;
+}
+function resolveApi(flags = {}) {
+  return flags.api || process.env.SKILLMD_API || readConfig().api || DEFAULT_API;
+}
+
+// ../cli/src/api.ts
+function createClient(flags = {}) {
+  const base = resolveApi(flags);
+  const token = resolveToken(flags);
+  async function api(path, init = {}) {
+    const headers = { accept: "application/json", ...init.headers };
+    if (token) headers.authorization = `Bearer ${token}`;
+    const res = await fetch(base + path, { ...init, headers });
+    if (!res.ok) {
+      const detail = await res.text().catch(() => "");
+      throw new Error(`SkillMD API ${res.status} on ${path}: ${detail}`);
+    }
+    return await res.json();
+  }
+  return { api, base, hasToken: Boolean(token) };
+}
+function reconstructSkillMd(skill) {
+  const name = skill.slug.split("/")[1] || skill.title;
+  const fm = ["---", `name: ${name}`, `description: ${String(skill.description).replace(/\n/g, " ")}`];
+  if (skill.license) fm.push(`license: ${skill.license}`);
+  fm.push("---", "");
+  return fm.join("\n") + (skill.body_md || "");
+}
+
+// ../cli/src/commands/search.ts
+async function runSearch(query, flags) {
+  const { api } = createClient(flags);
+  const params = new URLSearchParams({ q: query, limit: String(flags.limit ?? 20) });
+  if (flags.category) params.set("category", flags.category);
+  if (flags.verified) params.set("verified", "true");
+  if (flags.type) params.set("type", flags.type);
+  if (flags.minRating != null) params.set("min_rating", String(flags.minRating));
+  const r = await api(`/api/search?${params}`);
+  const items = r.items ?? [];
+  if (flags.json) return { items, output: JSON.stringify(items, null, 2) };
+  const lines = items.map((s) => {
+    const check = s.verified ? pc4.green("\u2713") : " ";
+    const rating = s.avg_rating ? pc4.dim(`\u2605${s.avg_rating.toFixed(1)} (${s.rating_count ?? 0})`) : "";
+    return `${check} ${pc4.bold(s.slug)} ${rating}
+    ${pc4.dim(s.description)}`;
+  });
+  return { items, output: lines.join("\n") || "No skills found." };
+}
+function searchCommand() {
+  return new Command5("search").description("Search the SkillMD registry").argument("<query>", "search terms").option("--category <slug>", "filter by category").option("--verified", "only verified skills").option("--type <type>", "single | pack").option("--min-rating <n>", "minimum average rating (0-5)").option("--limit <n>", "max results", "20").option("--json", "machine-readable output").action(async (query, opts, cmd) => {
+    const merged = { ...cmd.parent?.opts(), ...opts };
+    const run = await runSearch(query, merged);
+    console.log(run.output);
+  });
+}
+
+// ../cli/src/commands/add.ts
+import { Command as Command6 } from "commander";
+import { existsSync as existsSync4 } from "fs";
+import pc5 from "picocolors";
+
+// ../cli/src/agents.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, rmSync, symlinkSync, existsSync as existsSync3, readdirSync as readdirSync2, statSync as statSync2, readFileSync as readFileSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join4, resolve, dirname as dirname2 } from "path";
+var AGENTS = [
+  { id: "claude-code", segments: [".claude", "skills"] },
+  { id: "cursor", segments: [".cursor", "skills"] },
+  { id: "codex", segments: [".codex", "skills"] },
+  { id: "windsurf", segments: [".windsurf", "skills"] },
+  { id: "opencode", segments: [".opencode", "skills"] }
+];
+function agentDir(agentId, opts = {}) {
+  const agent = AGENTS.find((a) => a.id === agentId);
+  if (!agent) throw new Error(`Unknown agent: ${agentId}. Known: ${AGENTS.map((a) => a.id).join(", ")}`);
+  const root = opts.global ? homedir2() : opts.cwd ?? process.cwd();
+  return join4(root, ...agent.segments);
+}
+function detectAgents(opts = {}) {
+  return AGENTS.filter((a) => existsSync3(agentDir(a.id, opts))).map((a) => a.id);
+}
+function writeSkill(skillName, files, targetDir, opts = {}) {
+  const dest = join4(targetDir, skillName);
+  if (opts.mode === "symlink" && opts.canonicalDir) {
+    mkdirSync3(dirname2(dest), { recursive: true });
+    rmSync(dest, { recursive: true, force: true });
+    symlinkSync(resolve(opts.canonicalDir), dest, "dir");
+    return dest;
+  }
+  mkdirSync3(dest, { recursive: true });
+  for (const f of files) {
+    const fp = join4(dest, f.path);
+    mkdirSync3(dirname2(fp), { recursive: true });
+    writeFileSync4(fp, f.contents, "utf8");
+  }
+  return dest;
+}
+function installedSkills(opts = {}) {
+  const scope = opts.global ? "global" : "project";
+  const out = [];
+  for (const agent of AGENTS) {
+    const dir = agentDir(agent.id, opts);
+    if (!existsSync3(dir)) continue;
+    for (const entry of readdirSync2(dir)) {
+      const skillMd = join4(dir, entry, "SKILL.md");
+      if (!existsSync3(skillMd) || !statSync2(skillMd).isFile()) continue;
+      out.push({ name: entry, agent: agent.id, scope, path: join4(dir, entry), raw: readFileSync3(skillMd, "utf8") });
+    }
+  }
+  return out;
+}
+
+// ../cli/src/commands/add.ts
+function isLocalish(arg) {
+  return arg === "." || arg.startsWith("./") || arg.startsWith("../") || arg.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(arg) || existsSync4(arg);
+}
+var defaultDeps = {
+  async resolve(arg, flags) {
+    if (isLocalish(arg)) {
+      const rs2 = await resolveSource(arg);
+      return rs2.map((r) => ({ name: r.slug, raw: r.raw, slug: r.slug }));
+    }
+    if (/^[^/\s:]+\/[^/\s:]+$/.test(arg)) {
+      const { api } = createClient(flags);
+      const [owner, name] = arg.split("/");
+      try {
+        const skill = await api(`/api/skills/${owner}/${name}`);
+        const skillName = skill.slug.split("/")[1] || name;
+        return [{ name: skillName, raw: reconstructSkillMd(skill), slug: skillName, registrySlug: arg, verified: skill.verified }];
+      } catch {
+      }
+    }
+    const rs = await resolveSource(arg);
+    return rs.map((r) => ({ name: r.slug, raw: r.raw, slug: r.slug }));
+  },
+  fireInstall(registrySlug, flags) {
+    const { api } = createClient(flags);
+    const [owner, name] = registrySlug.split("/");
+    void api(`/api/skills/${owner}/${name}/install`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ via: "cli" })
+    }).catch(() => {
+    });
+  }
+};
+async function runAdd(arg, flags, deps = defaultDeps) {
+  let candidates = await deps.resolve(arg, flags);
+  if (flags.skill?.length) candidates = candidates.filter((c) => flags.skill.includes(c.name) || flags.skill.includes("*"));
+  const deny = new Set(flags.deny ?? []);
+  const written = [];
+  const blocked = [];
+  const lines = [];
+  const scope = { global: flags.global, cwd: flags.cwd };
+  const targets = flags.agent?.length ? flags.agent : detectAgents(scope).length ? detectAgents(scope) : ["claude-code"];
+  for (const c of candidates) {
+    const result = lint(c.raw, { slug: c.slug });
+    const deniedFlags = result.security.flags.filter((f) => deny.has(f));
+    if (!flags.skipLint && !result.ok) {
+      blocked.push({ name: c.name, reason: `lint errors: ${result.diagnostics.filter((d) => d.severity === "error").map((d) => d.id).join(", ")}` });
+      lines.push(pc5.red(`\u2717 ${c.name} blocked \u2014 failed lint (use --skip-lint to override)`));
+      continue;
+    }
+    if (deniedFlags.length) {
+      blocked.push({ name: c.name, reason: `denied security flags: ${deniedFlags.join(", ")}` });
+      lines.push(pc5.red(`\u2717 ${c.name} blocked \u2014 ${deniedFlags.join(", ")}`));
+      continue;
+    }
+    if (c.registrySlug && c.verified === false && !flags.allowUnverified) {
+      blocked.push({ name: c.name, reason: "unverified registry skill (use --allow-unverified)" });
+      lines.push(pc5.yellow(`\u2717 ${c.name} blocked \u2014 unverified (use --allow-unverified)`));
+      continue;
+    }
+    for (const agentId of targets) {
+      const dir = agentDir(agentId, scope);
+      const out = writeSkill(c.name, [{ path: "SKILL.md", contents: c.raw }], dir, { mode: "copy" });
+      written.push({ name: c.name, dir: out });
+      lines.push(pc5.green(`\u2713 ${c.name} \u2192 ${out}`));
+    }
+    if (c.registrySlug) deps.fireInstall(c.registrySlug, flags);
+  }
+  const exitCode = written.length === 0 ? 1 : 0;
+  return { written, blocked, exitCode, output: lines.join("\n") };
+}
+function addCommand() {
+  return new Command6("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to the user directory instead of the project").option("-a, --agent <agents...>", "target specific agents").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--copy", "copy files (default)", true).option("-y, --yes", "skip confirmation prompts").option("--allow-unverified", "allow installing unverified registry skills").option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills with these security flags").action(async (source, opts, cmd) => {
+    const merged = { ...cmd.parent?.opts(), ...opts };
+    const run = await runAdd(source, merged);
+    console.log(run.output);
+    process.exitCode = run.exitCode;
+  });
+}
+
+// ../cli/src/commands/list.ts
+import { Command as Command7 } from "commander";
+import pc6 from "picocolors";
+function listCommand() {
+  return new Command7("list").alias("ls").description("List installed skills across detected agents").option("-g, --global", "only global skills").option("--json", "machine-readable output").action((opts) => {
+    const scope = { global: opts.global };
+    const skills = installedSkills(scope);
+    if (opts.json) {
+      console.log(JSON.stringify(skills.map((s) => ({ name: s.name, agent: s.agent, scope: s.scope, path: s.path })), null, 2));
+      return;
+    }
+    if (skills.length === 0) {
+      console.log("No installed skills found.");
+      return;
+    }
+    for (const s of skills) {
+      const parsed = parseSkillMd(s.raw);
+      const desc = "error" in parsed ? pc6.red("(invalid SKILL.md)") : pc6.dim(parsed.description.slice(0, 80));
+      console.log(`${pc6.bold(s.name)} ${pc6.dim(`[${s.agent}/${s.scope}]`)}
+    ${desc}`);
+    }
+  });
+}
+
+// ../cli/src/commands/remove.ts
+import { Command as Command8 } from "commander";
+import { rmSync as rmSync2 } from "fs";
+import pc7 from "picocolors";
+function runRemove(names, scope = {}) {
+  const installed = installedSkills(scope);
+  const targets = installed.filter((s) => names.includes(s.name));
+  const removed = [];
+  const lines = [];
+  for (const t of targets) {
+    rmSync2(t.path, { recursive: true, force: true });
+    removed.push(t.path);
+    lines.push(pc7.green(`\u2713 removed ${t.name} (${t.agent})`));
+  }
+  for (const n of names) {
+    if (!targets.some((t) => t.name === n)) lines.push(pc7.yellow(`- ${n} not installed`));
+  }
+  return { removed, output: lines.join("\n") };
+}
+function removeCommand() {
+  return new Command8("remove").alias("rm").description("Remove installed skills").argument("<names...>", "skill names to remove").option("-g, --global", "only global skills").action((names, opts) => {
+    const run = runRemove(names, { global: opts.global });
+    console.log(run.output);
+  });
+}
+
+// ../cli/src/commands/update.ts
+import { Command as Command9 } from "commander";
+import { writeFileSync as writeFileSync5 } from "fs";
+import { join as join5 } from "path";
+import pc8 from "picocolors";
+async function runUpdate(names, flags, scope = {}) {
+  const { api } = createClient(flags);
+  const installed = installedSkills(scope).filter((s) => names.length === 0 || names.includes(s.name));
+  const updated = [];
+  const lines = [];
+  for (const s of installed) {
+    const slug = await findRegistrySlug(api, s);
+    if (!slug) {
+      lines.push(pc8.dim(`- ${s.name} skipped (no registry match)`));
+      continue;
+    }
+    try {
+      const [owner, name] = slug.split("/");
+      const skill = await api(`/api/skills/${owner}/${name}`);
+      const next = reconstructSkillMd(skill);
+      if (next.trim() === s.raw.trim()) {
+        lines.push(pc8.dim(`- ${s.name} already up to date`));
+        continue;
+      }
+      const result = lint(next, { slug: s.name });
+      if (!result.ok) {
+        lines.push(pc8.red(`\u2717 ${s.name} update failed lint \u2014 skipped`));
+        continue;
+      }
+      writeFileSync5(join5(s.path, "SKILL.md"), next, "utf8");
+      updated.push(s.name);
+      lines.push(pc8.green(`\u2713 updated ${s.name}`));
+    } catch {
+      lines.push(pc8.red(`\u2717 ${s.name} update error`));
+    }
+  }
+  return { updated, output: lines.join("\n") || "Nothing to update." };
+}
+async function findRegistrySlug(api, s) {
+  const r = await api(`/api/search?q=${encodeURIComponent(s.name)}&limit=5`).catch(() => null);
+  const hit = r?.items?.find((it) => it.slug.split("/")[1] === s.name);
+  return hit?.slug ?? null;
+}
+function updateCommand() {
+  return new Command9("update").description("Update installed skills from the registry (re-lints before writing)").argument("[names...]", "specific skills to update (default: all)").option("-g, --global", "only global skills").action(async (names, opts, cmd) => {
+    const merged = { ...cmd.parent?.opts(), ...opts };
+    const run = await runUpdate(names, merged, { global: opts.global });
+    console.log(run.output);
+  });
+}
+
+// ../cli/src/commands/publish.ts
+import { Command as Command10 } from "commander";
+import pc9 from "picocolors";
+var defaultDeps2 = {
+  resolve: resolveSource,
+  async submit(payload, flags) {
+    const { api, hasToken } = createClient(flags);
+    if (!hasToken) throw new Error("No token. Run `skillmd login` or pass --token.");
+    return api(`/api/skills`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(payload)
+    });
+  }
+};
+async function runPublish(target, flags, deps = defaultDeps2) {
+  const sources = await deps.resolve(target);
+  if (sources.length !== 1) {
+    return { result: lint(""), published: false, exitCode: 1, output: `Expected exactly one SKILL.md, found ${sources.length}.` };
+  }
+  const src = sources[0];
+  const result = lint(src.raw, { slug: src.slug });
+  const report = toText([{ file: src.path, result }], { decorate });
+  if (!result.ok) {
+    return { result, published: false, exitCode: 1, output: `${report}
+${pc9.red("\u2717 Refusing to publish: fix the errors above.")}` };
+  }
+  const hasWarn = result.diagnostics.some((d) => d.severity === "warn");
+  if (hasWarn && !flags.force) {
+    return { result, published: false, exitCode: 1, output: `${report}
+${pc9.yellow("\u2717 Warnings present. Re-run with --force to publish anyway.")}` };
+  }
+  if (flags.dryRun) {
+    return { result, published: false, exitCode: 0, output: `${report}
+${pc9.green("\u2713 Dry run: would publish.")}` };
+  }
+  const res = await deps.submit({ content: src.raw, type: flags.type ?? "single" }, flags);
+  return { result, published: true, slug: res.slug, exitCode: 0, output: `${report}
+${pc9.green(`\u2713 Published ${res.slug ?? src.slug} (status: ${res.status ?? "pending"})`)}` };
+}
+function publishCommand() {
+  return new Command10("publish").alias("submit").description("Publish a skill to the registry (refuses to publish on lint errors)").argument("[target]", "local path to the skill", ".").option("--type <type>", "single | pack", "single").option("--force", "publish despite warnings (never bypasses errors)").option("--dry-run", "lint only; do not publish").action(async (target, opts, cmd) => {
+    const merged = { ...cmd.parent?.opts(), ...opts };
+    const run = await runPublish(target, merged);
+    console.log(run.output);
+    process.exitCode = run.exitCode;
+  });
+}
+
+// ../cli/src/commands/login.ts
+import { Command as Command11 } from "commander";
+import * as p2 from "@clack/prompts";
+function loginCommand() {
+  return new Command11("login").description("Store a SkillMD personal access token for publishing").option("--token <token>", "token to store (otherwise prompt)").option("--api <url>", "registry API base to store").action(async (opts) => {
+    let token = opts.token;
+    if (!token) {
+      const answer = await p2.password({ message: "Paste your SkillMD token (from your account page)" });
+      if (p2.isCancel(answer)) {
+        p2.cancel("Cancelled.");
+        return;
+      }
+      token = answer;
+    }
+    if (!token) {
+      console.error("A token is required.");
+      process.exitCode = 1;
+      return;
+    }
+    const cfg = readConfig();
+    cfg.token = token;
+    if (opts.api) cfg.api = opts.api;
+    writeConfig(cfg);
+    console.log(`Saved token to ${configPath()}`);
+  });
+}
+function logoutCommand() {
+  return new Command11("logout").description("Remove the stored SkillMD token").action(() => {
+    const cfg = readConfig();
+    delete cfg.token;
+    writeConfig(cfg);
+    console.log("Removed stored token.");
+  });
+}
+
+// ../cli/src/index.ts
+var program = new Command12("skillmd").version("1.0.0").description("The registry that lints. Discover, validate, and install verified Agent Skills.").option("--json", "machine-readable output").option("--token <token>", "SkillMD personal access token").option("--api <url>", "override the registry API base URL");
+program.addCommand(lintCommand());
+program.addCommand(scanCommand());
+program.addCommand(rulesCommand());
+program.addCommand(initCommand());
+program.addCommand(searchCommand());
+program.addCommand(addCommand());
+program.addCommand(listCommand());
+program.addCommand(removeCommand());
+program.addCommand(updateCommand());
+program.addCommand(publishCommand());
+program.addCommand(loginCommand());
+program.addCommand(logoutCommand());
+program.parseAsync(process.argv).catch((err) => {
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exitCode = 1;
+});