skills 1.5.23 → 1.5.24

package/dist/cli.mjs

@@ -685,6 +685,25 @@ const CLONE_TIMEOUT_MS = (() => {
 	return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_CLONE_TIMEOUT_MS;
 })();
 const execFileAsync = promisify(execFile);
+function isCommitSha(ref) {
+	return /^[0-9a-f]{40}$/i.test(ref);
+}
+function isMissingRefError(message) {
+	return /Remote branch .* not found in upstream origin/i.test(message) || /couldn't find remote ref/i.test(message) || /upload-pack: not our ref/i.test(message);
+}
+async function cloneAtSha(url, sha, tempDir, extraEnv) {
+	const git = createGitClient(extraEnv);
+	await git.cwd(tempDir);
+	await git.init();
+	await git.addRemote("origin", url);
+	await git.fetch([
+		"--depth",
+		"1",
+		"origin",
+		sha
+	]);
+	await git.checkout("FETCH_HEAD");
+}
 var GitCloneError = class extends Error {
 	url;
 	isTimeout;
@@ -742,7 +761,7 @@ function isGitHubSsoAuthError(message) {
 function isAuthFailure(message) {
 	return message.includes("Authentication failed") || message.includes("could not read Username") || message.includes("Permission denied") || message.includes("Repository not found") || message.includes("requested URL returned error: 403") || isGitHubSsoAuthError(message);
 }
-function createGitClient(sshCommand) {
+function createGitClient(extraEnv) {
 	const git = esm_default({
 		timeout: { block: CLONE_TIMEOUT_MS },
 		config: [
@@ -778,7 +797,7 @@ function createGitClient(sshCommand) {
 		GIT_TERMINAL_PROMPT: "0",
 		GIT_ALLOW_PROTOCOL: ALLOWED_GIT_PROTOCOLS,
 		GIT_LFS_SKIP_SMUDGE: "1",
-		...sshCommand ? { GIT_SSH_COMMAND: sshCommand } : {}
+		...extraEnv
 	});
 	return git;
 }
@@ -846,12 +865,18 @@ async function cloneRepo(url, ref) {
 		"--branch",
 		ref
 	] : ["--depth", "1"];
+	const refCanBeSha = !!ref && isCommitSha(ref);
 	const repo = parseGitHubRepoUrl(url);
 	try {
 		await createGitClient().clone(url, tempDir, cloneOptions);
 		return tempDir;
 	} catch (error) {
 		const errorMessage = error instanceof Error ? error.message : String(error);
+		if (refCanBeSha && isMissingRefError(errorMessage)) try {
+			await resetTempDir(tempDir);
+			await cloneAtSha(url, ref, tempDir);
+			return tempDir;
+		} catch {}
 		const isTimeout = errorMessage.includes("block timeout") || errorMessage.includes("timed out");
 		const isAuthError = isAuthFailure(errorMessage);
 		if (isTimeout) {
@@ -868,7 +893,16 @@ async function cloneRepo(url, ref) {
 			} catch {}
 			try {
 				await resetTempDir(tempDir);
-				await createGitClient(process.env.GIT_SSH_COMMAND ?? "ssh -o BatchMode=yes").clone(repo.sshUrl, tempDir, cloneOptions);
+				const sshEnv = { GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND ?? "ssh -o BatchMode=yes" };
+				try {
+					await createGitClient(sshEnv).clone(repo.sshUrl, tempDir, cloneOptions);
+				} catch (sshError) {
+					const sshMessage = sshError instanceof Error ? sshError.message : String(sshError);
+					if (refCanBeSha && isMissingRefError(sshMessage)) {
+						await resetTempDir(tempDir);
+						await cloneAtSha(repo.sshUrl, ref, tempDir, sshEnv);
+					} else throw sshError;
+				}
 				return tempDir;
 			} catch {}
 		}
@@ -1127,7 +1161,7 @@ const AGENT_PROJECT_SKILL_DIRS = [
 	".zcode/skills",
 	".zencoder/skills"
 ];
-function normalizeSkillName(name) {
+function normalizeSkillName$1(name) {
 	return name.toLowerCase().replace(/[\s_]+/g, "-");
 }
 function normalizeRelativePath(path) {
@@ -1207,7 +1241,7 @@ async function discoverSkills(basePath, subpath, options) {
 	const seenNames = /* @__PURE__ */ new Set();
 	const parsedSkillPaths = /* @__PURE__ */ new Set();
 	const localLock = await readLocalLock(basePath);
-	const lockedSkillNames = new Set(Object.keys(localLock.skills).map(normalizeSkillName));
+	const lockedSkillNames = new Set(Object.keys(localLock.skills).map(normalizeSkillName$1));
 	if (subpath && !isSubpathSafe(basePath, subpath)) throw new Error(`Invalid subpath: "${subpath}" resolves outside the repository directory. Subpath must not contain ".." segments that escape the base path.`);
 	const searchPath = subpath ? join(basePath, subpath) : basePath;
 	const pluginGroupings = await getPluginGroupings(searchPath);
@@ -1220,8 +1254,8 @@ async function discoverSkills(basePath, subpath, options) {
 		if (lockedSkillNames.size === 0) return false;
 		const relativeDir = normalizeRelativePath(relative(basePath, skill.path));
 		if (!AGENT_PROJECT_SKILL_DIRS.some((dir) => relativeDir === dir || relativeDir.startsWith(`${dir}/`))) return false;
-		const skillName = normalizeSkillName(skill.name);
-		const directoryName = normalizeSkillName(basename(skill.path));
+		const skillName = normalizeSkillName$1(skill.name);
+		const directoryName = normalizeSkillName$1(basename(skill.path));
 		return lockedSkillNames.has(skillName) || lockedSkillNames.has(directoryName);
 	};
 	const parseSkillAt = async (skillDir) => {
@@ -1254,7 +1288,7 @@ async function discoverSkills(basePath, subpath, options) {
 	const tryAddSkillAt = async (skillDir) => {
 		if (!await hasSkillMd(skillDir)) return false;
 		let skill = await parseSkillAt(skillDir);
-		if (!skill || seenNames.has(skill.name)) return true;
+		if (!skill || !options?.includeDuplicateNames && seenNames.has(skill.name)) return true;
 		if (isInstalledProjectSkill(skill)) return true;
 		skill = enhanceSkill(skill);
 		skills.push(skill);
@@ -1277,7 +1311,7 @@ async function discoverSkills(basePath, subpath, options) {
 		const allSkillDirs = await findSkillDirs(searchPath);
 		for (const skillDir of allSkillDirs) {
 			let skill = await parseSkillAt(skillDir);
-			if (skill && !seenNames.has(skill.name) && !isInstalledProjectSkill(skill)) {
+			if (skill && (options?.includeDuplicateNames || !seenNames.has(skill.name)) && !isInstalledProjectSkill(skill)) {
 				skill = enhanceSkill(skill);
 				skills.push(skill);
 				seenNames.add(skill.name);
@@ -4017,7 +4051,7 @@ async function tryBlobInstall(ownerRepo, options = {}) {
 		tree
 	};
 }
-var version$1 = "1.5.23";
+var version$1 = "1.5.24";
 const isCancelled$1 = (value) => typeof value === "symbol";
 const EVE_AGENT_LABEL = "eve agent";
 async function isSourcePrivate(source) {
@@ -6366,6 +6400,46 @@ function parseRemoveOptions(args) {
 		options
 	};
 }
+function normalizeSkillName(name) {
+	return name.toLowerCase().replace(/[\s_]+/g, "-");
+}
+function normalizeSkillPath(path) {
+	return path.replace(/\\/g, "/").replace(/\/+/g, "/");
+}
+function resolveSkillLocations(lockedSkillNames, lockSkills, discovered) {
+	const discoveredPaths = new Set(discovered.map((skill) => normalizeSkillPath(skill.skillPath)));
+	const pathsByName = /* @__PURE__ */ new Map();
+	for (const skill of discovered) {
+		const key = normalizeSkillName(skill.name);
+		const paths = pathsByName.get(key) ?? /* @__PURE__ */ new Set();
+		paths.add(normalizeSkillPath(skill.skillPath));
+		pathsByName.set(key, paths);
+	}
+	const deletedSkills = [];
+	const ambiguousSkills = [];
+	const resolvedPaths = /* @__PURE__ */ new Map();
+	for (const name of lockedSkillNames) {
+		const lockedPath = lockSkills[name]?.skillPath;
+		if (!lockedPath) continue;
+		const normalizedLockedPath = normalizeSkillPath(lockedPath);
+		const candidates = [...pathsByName.get(normalizeSkillName(name)) ?? []];
+		if (candidates.length > 1) {
+			ambiguousSkills.push(name);
+			continue;
+		}
+		if (discoveredPaths.has(normalizedLockedPath)) {
+			resolvedPaths.set(name, normalizedLockedPath);
+			continue;
+		}
+		if (candidates.length === 1) resolvedPaths.set(name, candidates[0]);
+		else deletedSkills.push(name);
+	}
+	return {
+		deletedSkills,
+		ambiguousSkills,
+		resolvedPaths
+	};
+}
 const __dirname$1 = dirname(fileURLToPath(import.meta.url));
 const RESET$1 = "\x1B[0m";
 const BOLD$1 = "\x1B[1m";
@@ -6512,14 +6586,15 @@ async function promptDeletions(source, deletedSkills, isGlobal, options) {
 		});
 	}
 }
-async function checkAndPromptForDeletions(source, allLockedForSource, lockSkills, isGlobal, options, discoveredPaths) {
-	const deletedSkills = allLockedForSource.filter((name) => {
-		const entry = lockSkills[name];
-		if (!entry?.skillPath) return false;
-		return !discoveredPaths.includes(entry.skillPath);
-	});
-	await promptDeletions(source, deletedSkills, isGlobal, options);
-	return deletedSkills;
+async function checkAndPromptForDeletions(source, allLockedForSource, lockSkills, isGlobal, options, discovered) {
+	const resolution = resolveSkillLocations(allLockedForSource, lockSkills, discovered);
+	if (resolution.ambiguousSkills.length > 0) {
+		console.log();
+		console.log(`${DIM$1}Warning:${RESET$1} Multiple current paths match these skills from ${DIM$1}${source}${RESET$1}; skipping them rather than deleting or migrating the wrong skill:`);
+		for (const name of resolution.ambiguousSkills) console.log(`  ${DIM$1}•${RESET$1} ${sanitizeMetadata(name)}`);
+	}
+	await promptDeletions(source, resolution.deletedSkills, isGlobal, options);
+	return resolution;
 }
 async function checkWellKnownForUpdates(baseUrl, items) {
 	let indexResult;
@@ -6703,36 +6778,42 @@ async function updateGlobalSkills(options = {}) {
 				const tree = await fetchRepoTree(source, firstEntry.ref, getGitHubToken);
 				if (tree) {
 					const discoveredPaths = tree.tree.filter((entry) => entry.type === "blob").map((entry) => entry.path);
-					const deletedSkills = await checkAndPromptForDeletions(source, Object.entries(lock.skills).filter(([_, entry]) => entry.source === source && entry.ref === firstEntry.ref).map(([name, _]) => name), lock.skills, true, options, discoveredPaths);
-					const deletedSkillSet = new Set(deletedSkills);
-					for (const { name: skillName, entry } of itemsForSource) {
-						if (deletedSkillSet.has(skillName)) continue;
-						const latestHash = getSkillFolderHashFromTree(tree, entry.skillPath);
-						if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
-							name: skillName,
-							source,
-							entry
-						});
+					if (!Object.entries(lock.skills).filter(([_, entry]) => entry.source === source && entry.ref === firstEntry.ref).map(([name, _]) => name).some((name) => lock.skills[name]?.skillPath && !discoveredPaths.includes(lock.skills[name].skillPath))) {
+						for (const { name: skillName, entry } of itemsForSource) {
+							const latestHash = getSkillFolderHashFromTree(tree, entry.skillPath);
+							if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
+								name: skillName,
+								source,
+								entry
+							});
+						}
+						continue;
 					}
-					continue;
-				}
-				console.log(`  ${DIM$1}GitHub API unavailable; checking via Git clone${RESET$1}`);
+					console.log(`  ${DIM$1}Skill paths changed; resolving via Git clone${RESET$1}`);
+				} else console.log(`  ${DIM$1}GitHub API unavailable; checking via Git clone${RESET$1}`);
 			}
 			tempDir = await cloneRepo(sourceUrl, firstEntry.ref);
-			const discoveredPaths = (await discoverSkills(tempDir, void 0, { fullDepth: true })).map((skill) => {
-				return join(relative(tempDir, skill.path), "SKILL.md").split(sep).join("/");
-			});
-			const deletedSkills = await checkAndPromptForDeletions(source, Object.entries(lock.skills).filter(([_, entry]) => entry.source === source && entry.ref === firstEntry.ref).map(([name, _]) => name), lock.skills, true, options, discoveredPaths);
-			const deletedSkillSet = new Set(deletedSkills);
+			const discoveredLocations = (await discoverSkills(tempDir, void 0, {
+				fullDepth: true,
+				includeDuplicateNames: true
+			})).map((skill) => ({
+				name: skill.name,
+				skillPath: join(relative(tempDir, skill.path), "SKILL.md").split(sep).join("/")
+			}));
+			const resolution = await checkAndPromptForDeletions(source, Object.entries(lock.skills).filter(([_, entry]) => entry.source === source && entry.ref === firstEntry.ref).map(([name, _]) => name), lock.skills, true, options, discoveredLocations);
+			const deletedSkillSet = new Set(resolution.deletedSkills);
 			for (const { name: skillName, entry } of itemsForSource) {
 				if (deletedSkillSet.has(skillName)) continue;
-				const skillPath = entry.skillPath;
-				if (!discoveredPaths.includes(skillPath)) continue;
+				const skillPath = resolution.resolvedPaths.get(skillName);
+				if (!skillPath) continue;
 				const latestHash = isGitHubSource && /^[0-9a-f]{40}$/i.test(entry.skillFolderHash) ? await getGitTreeHash(tempDir, skillPath) : await computeSkillFolderHash(join(tempDir, dirname(skillPath)));
-				if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
+				if (skillPath !== entry.skillPath || latestHash && latestHash !== entry.skillFolderHash) updates.push({
 					name: skillName,
 					source,
-					entry
+					entry: {
+						...entry,
+						skillPath
+					}
 				});
 			}
 		} catch (error) {
@@ -6910,6 +6991,7 @@ async function updateProjectSkills(options = {}) {
 		const allLockedForSource = Object.entries(localLock.skills).filter(([_, entry]) => (entry.sourceUrl || entry.source) === source && entry.ref === ref).map(([name, _]) => name);
 		let tempDir = null;
 		let deletedSkills = [];
+		let resolvedPaths = null;
 		if (cloneSource === null) {
 			failCount += skillsForSource.length;
 			console.log(`${DIM$1}✗ Cannot update ${source}: skills-lock.json is missing sourceUrl for this generic Git source${RESET$1}`);
@@ -6917,27 +6999,43 @@ async function updateProjectSkills(options = {}) {
 		}
 		try {
 			tempDir = await cloneRepo(cloneSource, ref);
-			const discoveredPaths = (await discoverSkills(tempDir, void 0, { fullDepth: true })).map((s) => {
-				return join(relative(tempDir, s.path), "SKILL.md").split(sep).join("/");
-			});
-			deletedSkills = await checkAndPromptForDeletions(source, allLockedForSource, localLock.skills, false, options, discoveredPaths);
+			const discoveredLocations = (await discoverSkills(tempDir, void 0, {
+				fullDepth: true,
+				includeDuplicateNames: true
+			})).map((skill) => ({
+				name: skill.name,
+				skillPath: join(relative(tempDir, skill.path), "SKILL.md").split(sep).join("/")
+			}));
+			const resolution = await checkAndPromptForDeletions(source, allLockedForSource, localLock.skills, false, options, discoveredLocations);
+			deletedSkills = resolution.deletedSkills;
+			resolvedPaths = resolution.resolvedPaths;
 		} catch (error) {
 			console.log(`${DIM$1}✗ Failed to check for deleted skills from ${source}${RESET$1}`);
 		} finally {
 			if (tempDir) await cleanupTempDir(tempDir);
 		}
+		if (resolvedPaths === null) {
+			failCount += skillsForSource.length;
+			continue;
+		}
 		const remainingSkills = skillsForSource.filter((s) => !deletedSkills.includes(s.name));
 		for (const skill of remainingSkills) {
 			const safeName = sanitizeMetadata(skill.name);
+			const resolvedPath = resolvedPaths?.get(skill.name);
+			if (resolvedPaths && !resolvedPath) continue;
+			const entry = resolvedPath ? {
+				...skill.entry,
+				skillPath: resolvedPath
+			} : skill.entry;
 			console.log(`${TEXT$1}Updating ${safeName}…${RESET$1}`);
-			const installUrl = buildLocalUpdateSource(skill.entry);
+			const installUrl = buildLocalUpdateSource(entry);
 			if (!installUrl) {
 				failCount++;
 				console.log(`  ${DIM$1}✗ Cannot update ${safeName}: skills-lock.json is missing sourceUrl for this generic Git source${RESET$1}`);
 				continue;
 			}
 			const subagentArgs = skill.entry.subagents?.length ? ["--subagent", ...skill.entry.subagents.map((s) => s === "" ? "root" : s)] : [];
-			const fullDepthArgs = shouldUseFullDepthForUpdate(skill.entry) ? ["--full-depth"] : [];
+			const fullDepthArgs = shouldUseFullDepthForUpdate(entry) ? ["--full-depth"] : [];
 			if (spawnSync(process.execPath, [
 				cliEntry,
 				"add",
@@ -6954,7 +7052,7 @@ async function updateProjectSkills(options = {}) {
 					"pipe"
 				],
 				encoding: "utf-8",
-				env: getUpdateChildEnv(skill.entry.sourceType),
+				env: getUpdateChildEnv(entry.sourceType),
 				shell: false
 			}).status === 0) {
 				successCount++;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skills",
-  "version": "1.5.23",
+  "version": "1.5.24",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {