skillmds 1.2.0 → 1.3.0

package/dist/{chunk-A7BKAUUO.js → chunk-FVWCI37S.js}

@@ -19,6 +19,12 @@ function parseSource(arg, opts = {}) {
   const exists = opts.exists ?? existsSync;
   const a = arg.trim();
   if (!a) throw new Error("a source is required: owner/name, a GitHub URL, or a local path");
+  if (/^(plugin|pack):/i.test(a)) {
+    const body2 = a.slice(a.indexOf(":") + 1);
+    const m2 = body2.match(/^([^/#@\s]+)\/([^/#@\s]+)$/);
+    if (!m2) throw new Error(`"${a}" is not a valid plugin source \u2014 expected plugin:owner/slug`);
+    return { kind: "plugin", owner: m2[1], slug: m2[2], display: a };
+  }
   if (a === "~" || a.startsWith("~/") || a.startsWith("~\\")) {
     return { kind: "local", path: join(homedir(), a.slice(1)), display: a };
   }
@@ -54,6 +60,10 @@ function sourceId(spec) {
   switch (spec.kind) {
     case "slug":
       return `registry:${spec.owner}/${spec.name}`;
+    // Members are recorded under their own registry slug, not this one — the
+    // lock file tracks what was written, and a plugin is only how they arrived.
+    case "plugin":
+      return `plugin:${spec.owner}/${spec.slug}`;
     case "github":
       return `github:${spec.owner}/${spec.repo}${spec.subpath ? `/${spec.subpath}` : ""}${spec.ref ? `#${spec.ref}` : ""}${spec.skill ? `@${spec.skill}` : ""}`;
     case "gist":
@@ -182,13 +192,14 @@ async function fetchBundle(base, slug, token, opts = {}) {
   let bytes = 0;
   for (const f of data.files) {
     let contents;
+    let fromUrl = false;
     if (f.content_base64 != null) {
       contents = Buffer.from(f.content_base64, "base64");
     } else if (f.source_url && isAllowedSourceUrl(f.source_url)) {
-      if (!f.sha256) throw new IntegrityError(`"${f.path}" is delivered by URL but the registry recorded no sha256 for it \u2014 refusing to install unverifiable content`);
       const r = await doFetch(f.source_url).catch(() => null);
       if (!r || !r.ok) throw new Error(`could not fetch companion file "${f.path}" from ${hostOf(f.source_url)}`);
       contents = Buffer.from(await r.arrayBuffer());
+      fromUrl = true;
     } else {
       continue;
     }
@@ -197,10 +208,10 @@ async function fetchBundle(base, slug, token, opts = {}) {
     if (f.sha256) {
       const got = createHash("sha256").update(contents).digest("hex");
       if (got !== f.sha256) throw new IntegrityError(`integrity check failed for "${f.path}" (expected ${f.sha256.slice(0, 12)}\u2026, got ${got.slice(0, 12)}\u2026)`);
-    } else if (f.path !== "SKILL.md") {
+    } else if (!fromUrl && f.path !== "SKILL.md") {
       throw new IntegrityError(`"${f.path}" has no sha256 in the registry bundle \u2014 refusing to install unverifiable content`);
     }
-    out.push({ path: f.path, contents });
+    out.push({ path: f.path, contents, ...fromUrl && !f.sha256 ? { unverified: true } : {} });
   }
   return out;
 }
@@ -313,6 +324,9 @@ async function resolveSource(arg, opts = {}) {
     if (raw.length > MAX_PACK_BYTES) throw tooBig(raw.length);
     return [{ path: spec.display, raw, slug: `gist-${spec.id.slice(0, 8)}` }];
   }
+  if (spec.kind === "plugin") {
+    throw new Error(`"${spec.display}" is a plugin, not a single skill \u2014 install it with \`skillmd add ${spec.display}\`.`);
+  }
   const gh = asGithub(spec);
   const { dir, cleanup } = await downloadGithub(gh, "skillmd-src-", opts, Boolean(gh.subpath));
   try {

package/dist/cli.js

@@ -30,7 +30,7 @@ import {
   uninstallSkill,
   upsertEntry,
   writeConfig
-} from "./chunk-A7BKAUUO.js";
+} from "./chunk-FVWCI37S.js";
 
 // src/index.ts
 import { Command as Command13 } from "commander";
@@ -319,12 +319,12 @@ function lintCommand() {
       const s = p.spinner();
       s.start(`Scanning ${target}`);
       try {
-        const run2 = await runLint(target, opts);
-        s.stop(`Scanned ${run2.results.length} skill${run2.results.length === 1 ? "" : "s"}`);
-        console.log(run2.output);
-        const failed = run2.results.filter((r) => !r.result.ok).length;
+        const run3 = await runLint(target, opts);
+        s.stop(`Scanned ${run3.results.length} skill${run3.results.length === 1 ? "" : "s"}`);
+        console.log(run3.output);
+        const failed = run3.results.filter((r) => !r.result.ok).length;
         p.outro(failed === 0 ? pc2.green("All good") : pc2.red(`${failed} skill${failed === 1 ? "" : "s"} failed \u2014 details above`));
-        process.exitCode = run2.exitCode;
+        process.exitCode = run3.exitCode;
       } catch (err) {
         s.stop(pc2.red("No skills found"));
         p.outro(err instanceof Error ? err.message : String(err));
@@ -334,9 +334,9 @@ function lintCommand() {
     }
     process.stderr.write(`Looking for SKILL.md under ${target} \u2026
 `);
-    const run = await runLint(target, opts);
-    console.log(run.output);
-    process.exitCode = run.exitCode;
+    const run2 = await runLint(target, opts);
+    console.log(run2.output);
+    process.exitCode = run2.exitCode;
   });
 }
 
@@ -375,9 +375,9 @@ async function runScan(target, flags) {
 }
 function scanCommand() {
   return new Command2("scan").description("Security-scan SKILL.md file(s) for scripts, network calls and secret access").argument("[target]", "local path or GitHub source", ".").option("--deny <flags...>", "exit non-zero if any of these flags are present (e.g. executes_scripts)").option("--format <fmt>", "text | json", "text").action(async (target, opts) => {
-    const run = await runScan(target, opts);
-    console.log(run.output);
-    process.exitCode = run.exitCode;
+    const run2 = await runScan(target, opts);
+    console.log(run2.output);
+    process.exitCode = run2.exitCode;
   });
 }
 
@@ -504,8 +504,8 @@ async function runInit(nameArg, flags, deps = defaultInitDeps(flags)) {
     const file = initSkill(name, { dir: flags.dir, description: flags.description, license: flags.license });
     return { exitCode: 0, file, output: flags.json ? JSON.stringify({ ok: true, file }, null, 2) : `Created ${file}` };
   } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    return { exitCode: 1, output: flags.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : pc5.red(msg) };
+    const msg2 = e instanceof Error ? e.message : String(e);
+    return { exitCode: 1, output: flags.json ? JSON.stringify({ ok: false, error: msg2 }, null, 2) : pc5.red(msg2) };
   }
 }
 function initCommand() {
@@ -563,8 +563,8 @@ async function runSearch(query, flags) {
 function searchCommand() {
   return new Command5("search").description("Search the SkillMD registry").argument("<query>", "search terms").option("--category <slug>", "filter by category").option("--verified", "only verified skills").option("--type <type>", "single | pack").option("--min-rating <n>", "minimum average rating (0-5)").option("--limit <n>", "max results", "20").option("--json", "machine-readable output").action(async (query, opts, cmd) => {
     const merged = { ...cmd.parent?.opts(), ...opts };
-    const run = await runSearch(query, merged);
-    console.log(run.output);
+    const run2 = await runSearch(query, merged);
+    console.log(run2.output);
   });
 }
 
@@ -613,19 +613,99 @@ async function runInfo(slug, flags, deps = {}) {
 function infoCommand() {
   return new Command6("info").description("Show registry details for a skill: verification, security flags, provenance, rating").argument("<slug>", "owner/name, e.g. anthropic/pdf").action(async (slug, _opts, cmd) => {
     const flags = { ...cmd.parent?.opts() };
-    const run = await runInfo(slug, flags);
-    if (run.output) (run.ok ? console.log : console.error)(run.output);
-    process.exitCode = run.exitCode;
+    const run2 = await runInfo(slug, flags);
+    if (run2.output) (run2.ok ? console.log : console.error)(run2.output);
+    process.exitCode = run2.exitCode;
   });
 }
 
 // src/commands/add.ts
 import { Command as Command7, Option } from "commander";
-import { homedir as homedir3 } from "os";
+import { homedir as homedir4 } from "os";
 import * as p3 from "@clack/prompts";
 import { dirname, resolve as resolve3 } from "path";
 import pc8 from "picocolors";
 import { lint as lint2, parseSkillMd as parseSkillMd2 } from "@skillmds/core";
+
+// src/claudePlugin.ts
+import { execFile } from "child_process";
+import { existsSync as existsSync2 } from "fs";
+import { homedir as homedir3 } from "os";
+import { delimiter, join as join2 } from "path";
+import { promisify } from "util";
+var run = promisify(execFile);
+function resolveClaudeBin(env = process.env) {
+  const override = env.SKILLMD_CLAUDE_BIN;
+  if (override) return existsSync2(override) ? override : null;
+  const win = process.platform === "win32";
+  const exts = win ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  const dirs = (env.PATH ?? "").split(delimiter).filter(Boolean);
+  const home = env.USERPROFILE || env.HOME || homedir3();
+  dirs.push(join2(home, ".local", "bin"), join2(home, ".claude", "local"));
+  for (const dir of dirs) {
+    for (const ext of exts) {
+      const candidate = join2(dir, `claude${ext.toLowerCase()}`);
+      if (existsSync2(candidate)) return candidate;
+    }
+  }
+  return null;
+}
+var needsShell = (bin) => /\.(cmd|bat)$/i.test(bin);
+var MARKETPLACE_URL = "https://skillmd.com/.claude-plugin/marketplace.json";
+var MARKETPLACE_NAME = "skillmd";
+var TIMEOUT_MS = 12e4;
+function exec(deps) {
+  return deps.exec ?? ((file, args) => {
+    const bin = file === "claude" ? resolveClaudeBin() : file;
+    if (!bin) return Promise.reject(new Error("claude not found on PATH"));
+    return run(bin, args, { timeout: TIMEOUT_MS, windowsHide: true, shell: needsShell(bin) }).then((r) => ({
+      stdout: String(r.stdout ?? ""),
+      stderr: String(r.stderr ?? "")
+    }));
+  });
+}
+function marketplacePluginName(owner, slug) {
+  const clean = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  const base = clean(slug) || "plugin";
+  return owner.toLowerCase() === "skillmd" ? base : `${clean(owner)}-${base}`;
+}
+async function claudeCliAvailable(deps = {}) {
+  try {
+    await exec(deps)("claude", ["--version"]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function installClaudePlugin(owner, slug, deps = {}) {
+  const sh = exec(deps);
+  const qualified = `${marketplacePluginName(owner, slug)}@${MARKETPLACE_NAME}`;
+  try {
+    await sh("claude", ["plugin", "marketplace", "add", MARKETPLACE_URL]);
+  } catch (e) {
+    return { ok: false, reason: `could not add the SkillMD marketplace: ${msg(e)}` };
+  }
+  let out;
+  try {
+    const r = await sh("claude", ["plugin", "install", qualified]);
+    out = `${r.stdout}
+${r.stderr}`;
+  } catch (e) {
+    return { ok: false, reason: msg(e) };
+  }
+  if (/Successfully installed plugin/i.test(out)) return { ok: true, name: qualified, marketplace: MARKETPLACE_NAME };
+  const failed = /Failed to install plugin[^:]*:\s*(.+)/i.exec(out);
+  return { ok: false, reason: (failed?.[1] ?? out).trim().split(/\r?\n/)[0] ?? "install did not report success" };
+}
+function msg(e) {
+  if (e && typeof e === "object" && "stderr" in e) {
+    const s = String(e.stderr ?? "").trim();
+    if (s) return s.split(/\r?\n/)[0];
+  }
+  return e instanceof Error ? e.message.split(/\r?\n/)[0] : String(e);
+}
+
+// src/commands/add.ts
 var infoNotice = (text3) => ({ text: text3, style: "info" });
 var warnNotice = (text3) => ({ text: text3, style: "warn" });
 var skipNotice = (text3) => ({ text: text3, style: "skip" });
@@ -662,6 +742,10 @@ async function promptAgentsInteractive(ctx) {
   });
   return p3.isCancel(picked) ? null : picked;
 }
+function unverifiedFilesNote(n) {
+  const [f, it] = n === 1 ? ["file", "it"] : ["files", "them"];
+  return `${n} companion ${f} came straight from the source repo \u2014 the registry holds no checksum for ${it}, so only the connection was verified`;
+}
 function registryFallbackNote(host) {
   return `installed from GitHub because the SkillMD registry (${host}) was unreachable \u2014 this copy is not the registry-reviewed version`;
 }
@@ -689,6 +773,77 @@ function provenanceFor(arg) {
     return `unknown:${arg}`;
   }
 }
+async function registryCandidate(owner, name, source, client) {
+  const registrySlug = `${owner}/${name}`;
+  const skill = await client.api(`/api/skills/${owner}/${name}`);
+  const skillName = skill.slug.split("/")[1] || name;
+  const meta = {
+    name: skillName,
+    slug: skillName,
+    registrySlug,
+    source,
+    commit_sha: skill.commit_sha ?? void 0,
+    verified: skill.verified,
+    type: skill.type,
+    securityFlags: skill.security_flags
+  };
+  if (skill.type === "pack") {
+    const bundle = await fetchBundle(client.base, registrySlug, client.token);
+    if (bundle && bundle.length) {
+      const sk = bundle.find((file) => file.path === "SKILL.md");
+      const unverified = bundle.filter((file) => file.unverified).length;
+      return {
+        ...meta,
+        raw: sk ? sk.contents.toString("utf8") : skillMdFor(skill),
+        files: bundle,
+        ...unverified ? { note: unverifiedFilesNote(unverified) } : {}
+      };
+    }
+    const pack = await resolvePackFiles(skill);
+    if (pack) return { ...meta, ...pack };
+  }
+  return { ...meta, raw: skillMdFor(skill) };
+}
+async function fetchPackMembers(api, owner, slug) {
+  const PAGE = 200;
+  const members = [];
+  let name = slug;
+  let total = Infinity;
+  for (let offset = 0; members.length < total; offset += PAGE) {
+    const page = await api(`/api/packs/${owner}/${slug}?limit=${PAGE}&offset=${offset}`);
+    name = page.name || name;
+    total = Number(page.item_total ?? 0);
+    const got = (page.items ?? []).map((i) => ({ slug: String(i.slug ?? ""), type: i.type, verified: Boolean(i.verified) })).filter((i) => i.slug);
+    if (!got.length) break;
+    members.push(...got);
+  }
+  return { name, members };
+}
+function packDirNames(slugs) {
+  const used = /* @__PURE__ */ new Set();
+  return slugs.map((slug) => {
+    const [owner, name] = slug.split("/");
+    let dir = name ?? slug;
+    if (used.has(dir)) dir = `${owner}-${name}`;
+    used.add(dir);
+    return dir;
+  });
+}
+async function fetchPackArchive(base, owner, slug, token, doFetch = fetch) {
+  const headers = { accept: "application/zip" };
+  if (token) headers.authorization = `Bearer ${token}`;
+  const res = await doFetch(`${base}/api/packs/${owner}/${slug}/download`, { headers });
+  if (!res.ok) throw new RegistryError(`SkillMD API ${res.status} on /api/packs/${owner}/${slug}/download`, res.status);
+  const bytes = new Uint8Array(await res.arrayBuffer());
+  const { unzipSync, strFromU8 } = await import("fflate");
+  const entries = unzipSync(bytes);
+  const out = /* @__PURE__ */ new Map();
+  for (const [path, data] of Object.entries(entries)) {
+    const m = /^(.+)\/SKILL\.md$/.exec(path);
+    if (m) out.set(m[1], strFromU8(data));
+  }
+  return out;
+}
 function makeDefaultDeps(flags) {
   const canPrompt = () => isInteractive(flags, {
     stdinTTY: Boolean(process.stdin.isTTY),
@@ -699,6 +854,55 @@ function makeDefaultDeps(flags) {
     async resolve(arg, f) {
       const spec = parseSource(arg, { ref: f.ref });
       const source = sourceId(spec);
+      if (spec.kind === "plugin") {
+        const { api: api2, base: apiBase2, token: token2, fetch: doFetch } = createClient(f);
+        const { name: packName, members } = await fetchPackMembers(api2, spec.owner, spec.slug);
+        if (!members.length) throw new Error(`plugin ${spec.owner}/${spec.slug} has no installable skills`);
+        const archive = await fetchPackArchive(apiBase2, spec.owner, spec.slug, token2, doFetch);
+        const dirs = packDirNames(members.map((m) => m.slug));
+        const out = [];
+        const missing = [];
+        members.forEach((m, i) => {
+          const raw = archive.get(dirs[i]);
+          if (!raw) {
+            missing.push(m.slug);
+            return;
+          }
+          const name = dirs[i];
+          out.push({
+            name,
+            slug: name,
+            registrySlug: m.slug,
+            source,
+            raw,
+            verified: m.verified,
+            type: m.type
+          });
+        });
+        const multi = out.filter((c) => c.type === "pack");
+        if (multi.length) {
+          let n = 0;
+          await Promise.all(Array.from({ length: Math.min(4, multi.length) }, async () => {
+            for (let i = n++; i < multi.length; i = n++) {
+              const c = multi[i];
+              try {
+                const bundle = await fetchBundle(apiBase2, c.registrySlug, token2);
+                if (!bundle?.length) continue;
+                const sk = bundle.find((file) => file.path === "SKILL.md");
+                const unverified = bundle.filter((file) => file.unverified).length;
+                c.files = bundle;
+                if (sk) c.raw = sk.contents.toString("utf8");
+                if (unverified) c.note = unverifiedFilesNote(unverified);
+              } catch {
+              }
+            }
+          }));
+        }
+        if (!out.length) throw new Error(`plugin ${spec.owner}/${spec.slug} returned no readable skills`);
+        const first = out[0];
+        first.note = `${out.length} skill${out.length === 1 ? "" : "s"} from the ${packName} plugin` + (missing.length ? ` (${missing.length} member${missing.length === 1 ? "" : "s"} were not in the archive)` : "");
+        return out;
+      }
       if (spec.kind !== "slug") {
         const rs = await resolveSource(argWithRef(arg, f.ref));
         return rs.map((r) => ({
@@ -720,28 +924,7 @@ function makeDefaultDeps(flags) {
       })();
       const registrySlug = `${spec.owner}/${spec.name}`;
       try {
-        const skill = await api(`/api/skills/${spec.owner}/${spec.name}`);
-        const skillName = skill.slug.split("/")[1] || spec.name;
-        const meta = {
-          name: skillName,
-          slug: skillName,
-          registrySlug,
-          source,
-          commit_sha: skill.commit_sha ?? void 0,
-          verified: skill.verified,
-          type: skill.type,
-          securityFlags: skill.security_flags
-        };
-        if (skill.type === "pack") {
-          const bundle = await fetchBundle(apiBase, registrySlug, token);
-          if (bundle && bundle.length) {
-            const sk = bundle.find((file) => file.path === "SKILL.md");
-            return [{ ...meta, raw: sk ? sk.contents.toString("utf8") : skillMdFor(skill), files: bundle }];
-          }
-          const pack = await resolvePackFiles(skill);
-          if (pack) return [{ ...meta, ...pack }];
-        }
-        return [{ ...meta, raw: skillMdFor(skill) }];
+        return [await registryCandidate(spec.owner, spec.name, source, { api, base: apiBase, token })];
       } catch (e) {
         if (e instanceof IntegrityError) throw e;
         if (e instanceof RegistryError && e.status !== 404) registryDown = e;
@@ -775,7 +958,7 @@ function makeDefaultDeps(flags) {
   };
 }
 async function resolveScope(flags, deps) {
-  const home = resolve3(flags.home ?? homedir3());
+  const home = resolve3(flags.home ?? homedir4());
   const cwd = resolve3(flags.cwd ?? process.cwd());
   const base = { cwd: flags.cwd, home: flags.home, env: flags.env };
   if (flags.global) return { scope: { global: true, ...base } };
@@ -798,7 +981,7 @@ function defaultNeedsPrompt(flags) {
   const env = flags.env ?? process.env;
   if (flags.yes || flags.json || flags.global || flags.project || flags.list) return false;
   if (detectHostAgent(env)) return false;
-  if (resolve3(flags.cwd ?? process.cwd()) === resolve3(flags.home ?? homedir3())) return false;
+  if (resolve3(flags.cwd ?? process.cwd()) === resolve3(flags.home ?? homedir4())) return false;
   return !isInteractive(flags, { stdinTTY: Boolean(process.stdin.isTTY), stdoutTTY: Boolean(process.stdout.isTTY), env });
 }
 var CANCELLED_TEXT = "installation cancelled \u2014 nothing was installed";
@@ -813,7 +996,7 @@ function finish2(flags, outcome) {
         ...outcome.notices,
         ...outcome.records.flatMap((r) => r.kind === "installed" ? r.notices : [])
       ].map((n) => n.text);
-      const exitCode = blocked.length > 0 || installed.length === 0 ? 1 : 0;
+      const exitCode = blocked.length > 0 || installed.length === 0 && !outcome.managed ? 1 : 0;
       const doc = { ok: exitCode === 0, scope: outcome.scope, installed, blocked, warnings };
       return {
         written,
@@ -975,9 +1158,28 @@ async function installOne(c, ctx) {
     ...out.replaced ? { replaced: out.replaced } : {}
   };
 }
+async function tryPluginInstall(arg, flags) {
+  let spec;
+  try {
+    spec = parseSource(arg, { ref: flags.ref });
+  } catch {
+    return null;
+  }
+  if (spec.kind !== "plugin") return null;
+  if (flags.agent?.length || flags.skill?.length || flags.list || flags.mode === "copy") return null;
+  if (!await claudeCliAvailable()) return null;
+  const res = await installClaudePlugin(spec.owner, spec.slug);
+  if (!res.ok) return null;
+  return {
+    agent: "claude-code",
+    name: res.name,
+    note: `installed ${res.name} as a Claude Code plugin \u2014 manage it with \`claude plugin\` or /plugin`
+  };
+}
 async function runAdd(arg, flags, deps) {
   const d = deps ?? makeDefaultDeps(flags);
   const env = flags.env ?? process.env;
+  const managed = await tryPluginInstall(arg, flags);
   let candidates;
   try {
     candidates = await resolveCandidates(arg, flags, d);
@@ -994,14 +1196,20 @@ async function runAdd(arg, flags, deps) {
   if (!resolved) return finish2(flags, { kind: "cancel" });
   const scope = resolved.scope;
   const notices = resolved.note ? [infoNotice(resolved.note)] : [];
-  const chosen = await chooseTargets(flags, d, scope, detectAgents(scope));
+  if (managed) notices.push(infoNotice(managed.note));
+  const detected = detectAgents(scope).filter((id) => id !== managed?.agent);
+  if (managed && !detected.length) {
+    const paths2 = { home: flags.home ?? homedir4(), cwd: flags.cwd ?? process.cwd() };
+    return finish2(flags, { kind: "install", scope: scope.global ? "global" : "project", records: [], notices, paths: paths2, managed: managed.name });
+  }
+  const chosen = await chooseTargets(flags, d, scope, detected);
   if (!chosen) return finish2(flags, { kind: "cancel" });
   notices.push(...chosen.notices);
   const ctx = { arg, flags, deny: new Set(flags.deny ?? []), scope, targets: chosen.targets, env, deps: d };
   const records = [];
   for (const c of candidates) records.push(await installOne(c, ctx));
-  const paths = { home: flags.home ?? homedir3(), cwd: flags.cwd ?? process.cwd() };
-  return finish2(flags, { kind: "install", scope: scope.global ? "global" : "project", records, notices, paths });
+  const paths = { home: flags.home ?? homedir4(), cwd: flags.cwd ?? process.cwd() };
+  return finish2(flags, { kind: "install", scope: scope.global ? "global" : "project", records, notices, paths, ...managed ? { managed: managed.name } : {} });
 }
 function addFlags(opts, parent) {
   const merged = { ...parent, ...opts };
@@ -1011,12 +1219,12 @@ function addFlags(opts, parent) {
 function addCommand() {
   return new Command7("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to your user-level agent folders (available in every project)").option("-p, --project", "install into the current directory's agent folders (committed with the project)").option("-a, --agent <agents...>", "target specific agents (default: every agent detected on this machine)").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--ref <ref>", "git ref (branch, tag or commit) for GitHub sources").option("-l, --list", "list the skills a source contains without installing").addOption(new Option("--mode <mode>", "link (junction/symlink into each agent dir, default) or copy").choices(["link", "copy"]).default("link")).option("--force", "replace a skill installed from a different source, or an untracked directory").addOption(new Option("--copy", "alias of --mode copy").hideHelp()).option("-y, --yes", "skip prompts; scope is auto-detected (project if this folder looks like a project, else global)").addOption(new Option("--allow-unverified").hideHelp()).option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills carrying any of these security flags (opt-in)").action(async (source, opts, cmd) => {
     const merged = addFlags(opts, cmd.parent?.opts());
-    const { run, printed } = await runAddWithUI(source, merged);
+    const { run: run2, printed } = await runAddWithUI(source, merged);
     if (!printed) {
-      if (run.exitCode === 1 && !merged.json) console.error(run.output);
-      else console.log(run.output);
+      if (run2.exitCode === 1 && !merged.json) console.error(run2.output);
+      else console.log(run2.output);
     }
-    process.exitCode = run.exitCode;
+    process.exitCode = run2.exitCode;
   });
 }
 var clackUI = {
@@ -1033,7 +1241,7 @@ async function runAddWithUI(source, flags, opts = {}) {
   const ui = opts.ui ?? clackUI;
   ui.intro(banner());
   try {
-    const run = await runAdd(source, flags, {
+    const run2 = await runAdd(source, flags, {
       // NOTE: spreading `base` reads makeDefaultDeps()'s promptScope/promptAgents
       // getters right here, freezing their values for this run. That is exactly
       // what we want (interactivity is decided once, up front), but it does mean
@@ -1053,13 +1261,13 @@ async function runAddWithUI(source, flags, opts = {}) {
         }
       }
     });
-    if (run.cancelled) {
+    if (run2.cancelled) {
       ui.cancel("Installation cancelled \u2014 nothing was installed.");
-      return { run, printed: true };
+      return { run: run2, printed: true };
     }
-    ui.message(run.output);
-    ui.outro(run.exitCode === 0 ? `Done. Run ${pc8.cyan("skillmd list")} to see everything installed.` : pc8.red("Some skills were not installed."));
-    return { run, printed: true };
+    ui.message(run2.output);
+    ui.outro(run2.exitCode === 0 ? `Done. Run ${pc8.cyan("skillmd list")} to see everything installed.` : pc8.red("Some skills were not installed."));
+    return { run: run2, printed: true };
   } catch (e) {
     ui.outro(pc8.red("Nothing was installed."));
     throw e;
@@ -1068,8 +1276,8 @@ async function runAddWithUI(source, flags, opts = {}) {
 
 // src/commands/list.ts
 import { Command as Command8 } from "commander";
-import { existsSync as existsSync2, readFileSync } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync3, readFileSync } from "fs";
+import { join as join4 } from "path";
 import pc9 from "picocolors";
 import { parseSkillMd as parseSkillMd3 } from "@skillmds/core";
 function runList(flags = {}) {
@@ -1077,9 +1285,9 @@ function runList(flags = {}) {
   let items = [];
   for (const global of scopes) {
     for (const s of listInstalled({ global, cwd: flags.cwd, home: flags.home })) {
-      const md = join3(s.path, "SKILL.md");
+      const md = join4(s.path, "SKILL.md");
       let description = "";
-      if (existsSync2(md)) {
+      if (existsSync3(md)) {
         const parsed = parseSkillMd3(readFileSync(md, "utf8"));
         description = "error" in parsed ? `(invalid SKILL.md \u2014 ${parsed.error})` : parsed.description;
       }
@@ -1110,12 +1318,12 @@ function listCommand() {
 // src/commands/remove.ts
 import { Command as Command9 } from "commander";
 import { rmSync } from "fs";
-import { join as join4, resolve as resolve4 } from "path";
+import { join as join5, resolve as resolve4 } from "path";
 import * as p4 from "@clack/prompts";
 import pc10 from "picocolors";
 var defaultDeps = (flags) => isInteractive(flags) ? {
-  confirm: async (msg) => {
-    const a = await p4.confirm({ message: msg, initialValue: false });
+  confirm: async (msg2) => {
+    const a = await p4.confirm({ message: msg2, initialValue: false });
     return !p4.isCancel(a) && a;
   },
   pick: async ({ names }) => {
@@ -1198,7 +1406,7 @@ async function runRemove(names, flags, deps = defaultDeps(flags)) {
             acted = true;
             continue;
           }
-          const pth = join4(dir, name);
+          const pth = join5(dir, name);
           if (isSkillDirOrLink(pth)) {
             rmSync(pth, { recursive: true, force: true });
             removed.push(pth);
@@ -1232,9 +1440,9 @@ async function runRemove(names, flags, deps = defaultDeps(flags)) {
 }
 function removeCommand() {
   return new Command9("remove").alias("rm").description("Remove installed skills (links, canonical copy and lock entry)").argument("[names...]", "skill names (omit to pick interactively)").option("-g, --global", "only user-level skills").option("-p, --project", "only this project's skills").option("-a, --agent <agents...>", "remove only from these agents").option("--all", "remove every skill in the scope").option("-y, --yes", "skip the confirmation").option("--json", "machine-readable output").action(async (names, opts, cmd) => {
-    const run = await runRemove(names, { ...cmd.parent?.opts(), ...opts });
-    console.log(run.output);
-    process.exitCode = run.exitCode;
+    const run2 = await runRemove(names, { ...cmd.parent?.opts(), ...opts });
+    console.log(run2.output);
+    process.exitCode = run2.exitCode;
   });
 }
 
@@ -1368,16 +1576,16 @@ function scopeOptions(cmd) {
 }
 function updateCommand() {
   return scopeOptions(new Command10("update").description("Update installed skills from the source recorded in the lock file (re-lints before writing)").argument("[names...]", "specific skills (default: all tracked)").option("--check", "only report which skills have updates")).action(async (names, opts, cmd) => {
-    const run = await runUpdate(names, { ...cmd.parent?.opts(), ...opts });
-    console.log(run.output);
-    process.exitCode = run.exitCode;
+    const run2 = await runUpdate(names, { ...cmd.parent?.opts(), ...opts });
+    console.log(run2.output);
+    process.exitCode = run2.exitCode;
   });
 }
 function checkCommand() {
   return scopeOptions(new Command10("check").description("Report installed skills that have updates (alias of `update --check`)").argument("[names...]", "specific skills (default: all tracked)")).action(async (names, opts, cmd) => {
-    const run = await runUpdate(names, { ...cmd.parent?.opts(), ...opts, check: true });
-    console.log(run.output);
-    process.exitCode = run.exitCode;
+    const run2 = await runUpdate(names, { ...cmd.parent?.opts(), ...opts, check: true });
+    console.log(run2.output);
+    process.exitCode = run2.exitCode;
   });
 }
 
@@ -1425,9 +1633,9 @@ ${pc12.green(`\u2713 Published ${res.slug ?? src.slug} (status: ${res.status ??
 function publishCommand() {
   return new Command11("publish").alias("submit").description("Publish a skill to the registry (refuses to publish on lint errors)").argument("[target]", "local path to the skill", ".").option("--type <type>", "single | pack", "single").option("--force", "publish despite warnings (never bypasses errors)").option("--dry-run", "lint only; do not publish").action(async (target, opts, cmd) => {
     const merged = { ...cmd.parent?.opts(), ...opts };
-    const run = await runPublish(target, merged);
-    console.log(run.output);
-    process.exitCode = run.exitCode;
+    const run2 = await runPublish(target, merged);
+    console.log(run2.output);
+    process.exitCode = run2.exitCode;
   });
 }
 
@@ -1463,8 +1671,8 @@ async function runLogin(flags, deps = defaultLoginDeps(flags)) {
   try {
     host = hostOf(resolveApi({ api: flags.api, insecureHttp: flags.insecureHttp }, { env, config: { ...cfg, api: flags.api ?? cfg.api } }));
   } catch (e) {
-    const msg = e instanceof Error ? e.message : String(e);
-    return { exitCode: 1, output: flags.json ? JSON.stringify({ ok: false, error: msg }, null, 2) : pc13.red(msg) };
+    const msg2 = e instanceof Error ? e.message : String(e);
+    return { exitCode: 1, output: flags.json ? JSON.stringify({ ok: false, error: msg2 }, null, 2) : pc13.red(msg2) };
   }
   cfg.token = token;
   if (flags.api) cfg.api = flags.api;
@@ -1566,9 +1774,9 @@ async function browseOneResult(item) {
     }
     p6.log.step(`Installing ${slugTxt}\u2026`);
     try {
-      const run = await runAdd(item.slug, action === "global" ? { global: true } : { project: true });
-      console.log(run.output);
-      if (run.exitCode === 0) p6.log.success("Installed.");
+      const run2 = await runAdd(item.slug, action === "global" ? { global: true } : { project: true });
+      console.log(run2.output);
+      if (run2.exitCode === 0) p6.log.success("Installed.");
       else p6.log.warn("Not installed.");
     } catch (err) {
       p6.log.error(err instanceof Error ? err.message : String(err));
@@ -1603,10 +1811,10 @@ async function runInteractive() {
         const s = p6.spinner();
         s.start(action === "lint" ? "Linting" : "Scanning");
         try {
-          const run = action === "lint" ? await runLint(target, { format: "text" }) : await runScan(target, { format: "text" });
+          const run2 = action === "lint" ? await runLint(target, { format: "text" }) : await runScan(target, { format: "text" });
           s.stop("Done");
-          console.log(run.output);
-          process.exitCode = run.exitCode;
+          console.log(run2.output);
+          process.exitCode = run2.exitCode;
         } catch (err) {
           s.stop(pc14.red(err instanceof Error ? err.message : String(err)));
           process.exitCode = 1;
@@ -1621,13 +1829,13 @@ async function runInteractive() {
         const s = p6.spinner();
         s.start("Searching");
         try {
-          const run = await runSearch(String(query), { verified: Boolean(verified), limit: "20" });
-          s.stop(`${run.items.length} result${run.items.length === 1 ? "" : "s"}`);
-          if (run.items.length === 0) {
+          const run2 = await runSearch(String(query), { verified: Boolean(verified), limit: "20" });
+          s.stop(`${run2.items.length} result${run2.items.length === 1 ? "" : "s"}`);
+          if (run2.items.length === 0) {
             p6.log.info("No results.");
             break;
           }
-          await browseSearchResults(run.items);
+          await browseSearchResults(run2.items);
         } catch (err) {
           s.stop(pc14.red(err instanceof Error ? err.message : String(err)));
           process.exitCode = 1;
@@ -1652,9 +1860,9 @@ async function runInteractive() {
         const src = await p6.text({ message: "Skill source", placeholder: "owner/name, https://github.com/\u2026, or ./path" });
         if (bail(src)) break;
         try {
-          const run = await runAdd(String(src), {});
-          console.log(run.output);
-          process.exitCode = run.exitCode;
+          const run2 = await runAdd(String(src), {});
+          console.log(run2.output);
+          process.exitCode = run2.exitCode;
         } catch (err) {
           p6.log.error(err instanceof Error ? err.message : String(err));
           process.exitCode = 1;
@@ -1667,9 +1875,9 @@ async function runInteractive() {
       }
       case "update": {
         try {
-          const run = await runUpdate([], {});
-          console.log(run.output);
-          process.exitCode = run.exitCode;
+          const run2 = await runUpdate([], {});
+          console.log(run2.output);
+          process.exitCode = run2.exitCode;
         } catch (err) {
           p6.log.error(err instanceof Error ? err.message : String(err));
           process.exitCode = 1;
@@ -1678,9 +1886,9 @@ async function runInteractive() {
       }
       case "remove": {
         try {
-          const run = await runRemove([], {});
-          console.log(run.output);
-          process.exitCode = run.exitCode;
+          const run2 = await runRemove([], {});
+          console.log(run2.output);
+          process.exitCode = run2.exitCode;
         } catch (err) {
           p6.log.error(err instanceof Error ? err.message : String(err));
           process.exitCode = 1;

package/dist/mcp.js

@@ -12,7 +12,7 @@ import {
   safeText,
   stripTerminalEscapes,
   telemetryDisabled
-} from "./chunk-A7BKAUUO.js";
+} from "./chunk-FVWCI37S.js";
 
 // src/mcp/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillmds",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.",
   "license": "MIT",
   "author": "SkillMD",
@@ -59,6 +59,7 @@
     "@modelcontextprotocol/sdk": "^1.13.0",
     "@skillmds/core": "^1.0.0",
     "commander": "^12.1.0",
+    "fflate": "^0.8.3",
     "giget": "^3.3.0",
     "picocolors": "^1.1.0"
   },