skillsauth 2.0.0 → 3.0.2

package/README.md

@@ -1,140 +1,317 @@
-# skillsauth
+<p align="center">
+  <img src="https://skillsauth.com/icon.svg" alt="SkillsAuth" width="80" />
+</p>
 
-Install verified AI agent skills from the [SkillsAuth](https://skillsauth.com) marketplace.
+<h1 align="center">SkillsAuth</h1>
 
-## Installation
+<p align="center">
+  <strong>Install verified AI agent skills from the <a href="https://skillsauth.com">SkillsAuth</a> marketplace.</strong>
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/skillsauth"><img src="https://img.shields.io/npm/v/skillsauth?color=0ea5e9&label=npm" alt="npm" /></a>
+  <a href="https://www.npmjs.com/package/skillsauth"><img src="https://img.shields.io/npm/dm/skillsauth?color=6366f1" alt="downloads" /></a>
+  <a href="https://github.com/beinghimansh/skillsauth/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-22c55e" alt="license" /></a>
+  <a href="https://skillsauth.com"><img src="https://img.shields.io/badge/marketplace-skillsauth.com-f59e0b" alt="marketplace" /></a>
+</p>
+
+---
+
+## Quick Start
 
 ```bash
 npm install -g skillsauth
-# or
-npx skillsauth <command>
 ```
 
-## Quick Start
+```bash
+skillsauth search "react"                    # Search the marketplace
+skillsauth list anthropics/skills            # List skills in a verified repo
+skillsauth add anthropics/skills           # Install interactively
+skillsauth add huggingface/skills -y -g    # Install all, globally, no prompts
+skillsauth find                            # Interactive skill discovery
+```
+
+Examples below use **verified publishers** already on [SkillsAuth](https://skillsauth.com): [`anthropics/skills`](https://github.com/anthropics/skills), [`huggingface/skills`](https://github.com/huggingface/skills), and [`letta-ai/skills`](https://github.com/letta-ai/skills).
+
+---
+
+## Install a skill (`add` / `install` / `i`)
+
+### Source formats
+
+| Format | Example |
+|--------|---------|
+| GitHub shorthand | `skillsauth add anthropics/skills` |
+| Local path (plugin or `skills/` tree) | `skillsauth add ./my-plugin` |
+
+Remote installs use `owner/repo` only (no raw GitHub URL in the CLI today). Use **`list`** first to see exact skill names, then **`add owner/repo "Skill Name"`**.
+
+### Options
+
+| Option | Description |
+|--------|-------------|
+| `-g, --global` | Install under your home directory instead of the current project |
+| `-y, --yes` | Skip confirmation prompts (CI / scripts) |
+| `--agent <names...>` | Target specific agents (see [Supported agents](#supported-agents)) |
+| `--all` | Install every skill from the repo without selecting |
+| `--copy` | Copy files into each agent dir instead of symlinks |
+| `--json` | Machine-readable JSON output |
+
+### Examples (verified repos)
 
 ```bash
-# Search for skills
-skillsauth search "react"
+# List skills in a repo (no install)
+skillsauth list huggingface/skills
+skillsauth ls letta-ai/skills
 
-# List skills in a repository
-skillsauth list facebook/react
+# Interactive install — pick skills, scope, and agents
+skillsauth add anthropics/skills
 
-# Install all skills from a repo
-skillsauth add facebook/react
+# Install one named skill (use the name shown by `list`)
+skillsauth add anthropics/skills "skill-creator"
 
-# Install with auto-confirm
-skillsauth add facebook/react --yes
+# Install all skills from a repo, project scope, no prompts
+skillsauth add huggingface/skills --yes --all
 
-# Install globally (all projects)
-skillsauth add facebook/react --global
+# Global install, Cursor + Claude only
+skillsauth add letta-ai/skills --global --yes --agent cursor claude-code
+
+# CI: JSON output
+skillsauth add huggingface/skills --json --yes --all
+
+# Local plugin / folder with SKILL.md or plugin manifests
+skillsauth add ./my-plugin --all --yes
 ```
 
-## Commands
+### Installation scope
+
+| Scope | Flag | Lockfile | Use case |
+|-------|------|----------|----------|
+| **Project** | _(default)_ | `.skillsauth-lock.json` | Per-repo, team-shared |
+| **Global** | `-g` / `--global` | `~/.skillsauth/lock.json` | All projects on your machine |
+
+### Installation methods
+
+| Method | Description |
+|--------|-------------|
+| **Symlink** (default) | One canonical copy under `.agents/skills/<slug>/`, linked from each agent. Recommended. |
+| **Copy** | `--copy` — full copies per agent when symlinks are not allowed. |
+
+---
+
+## Other commands
+
+| Command | Alias | Description |
+|---------|-------|-------------|
+| `skillsauth list <repo>` | `ls` | List published skills in a GitHub repo on SkillsAuth |
+| `skillsauth search <query>` | | Search the whole marketplace |
+| `skillsauth find [query]` | | Interactive search + suggested `add` command |
+| `skillsauth installed` | `status` | Show what is installed (local or global) |
+| `skillsauth check` | | See if updates exist (does not install) |
+| `skillsauth update` | `upgrade` | Pull latest versions for lockfile entries |
+| `skillsauth remove <slug>` | `uninstall`, `rm` | Uninstall a skill by marketplace slug |
+| `skillsauth init` | | Scaffold `SKILL.md` or `--plugin` bundle |
+| `skillsauth agents` | | Print all supported agent IDs |
+
+### `skillsauth list` / `ls`
 
-### `add <repo> [skill]`
-Install skills from a repository.
+Lists **verified, published** skills for an `owner/repo` that SkillsAuth has ingested.
 
 ```bash
-skillsauth add owner/repo              # Interactive install
-skillsauth add owner/repo --yes        # Auto-confirm
-skillsauth add owner/repo --global     # Install globally
-skillsauth add owner/repo skill-name   # Install specific skill
+skillsauth list anthropics/skills
+skillsauth ls huggingface/skills
+skillsauth ls letta-ai/skills
 ```
 
-Options:
-- `-g, --global` — Install to global directory (~/.claude/skills/)
-- `-y, --yes` — Skip all prompts
+Use the **name** column with `skillsauth add owner/repo "Exact Name"`.
 
-### `list <repo>`
-List all verified skills in a repository.
+### `skillsauth search`
+
+Keyword search across the marketplace (name, description, category, repo, trigger phrase).
 
 ```bash
-skillsauth list facebook/react
+skillsauth search "typescript"
+skillsauth search "gradio" --limit 15
 ```
 
-### `search <query>`
-Search the SkillsAuth marketplace.
+### `skillsauth find`
+
+Interactive picker after search; prints a ready-to-run `npx skillsauth add ...` line.
 
 ```bash
-skillsauth search "typescript"
-skillsauth search "api" --limit 20
+skillsauth find
+skillsauth find "docker"
+skillsauth find --json
 ```
 
-Options:
-- `-l, --limit <n>` — Max results (default: 10)
+### `skillsauth installed` / `status`
 
-### `installed`
-Show installed skills.
+Like `npm ls` for skills: slug, version, agents.
 
 ```bash
-skillsauth installed            # Local installs
-skillsauth installed --global   # Global installs
+skillsauth installed
+skillsauth installed --global
+skillsauth installed --json
 ```
 
-Options:
-- `-g, --global` — Show global installs
+### `skillsauth check` / `skillsauth update`
 
-### `update`
-Update all installed skills to latest versions.
+```bash
+# Read-only: outdated vs latest, quarantine warnings
+skillsauth check
+skillsauth check --global --json
+
+# Apply updates from the marketplace
+skillsauth update
+skillsauth update --global
+```
+
+### `skillsauth remove` / `uninstall` / `rm`
+
+Removes by **slug** from `installed` (the short marketplace id, e.g. `anthropics-skill-creator` for `anthropics/skills` + `skill-creator`), not by repo path. Copy the slug from `skillsauth installed` or `list` if unsure.
 
 ```bash
-skillsauth update            # Update local
-skillsauth update --global   # Update global
+skillsauth installed   # copy the slug column from output
+
+skillsauth remove anthropics-skill-creator
+skillsauth rm anthropics-skill-creator --yes
+skillsauth remove your-skill-slug --global --yes
 ```
 
-Options:
-- `-g, --global` — Update global installs
+| Option | Description |
+|--------|-------------|
+| `-g, --global` | Use global lockfile / paths |
+| `-y, --yes` | Skip confirm |
 
-### `remove <slug>`
-Remove an installed skill.
+### `skillsauth init`
 
 ```bash
-skillsauth remove facebook-react-flow
-skillsauth remove facebook-react-flow --yes
-skillsauth remove facebook-react-flow --global
+skillsauth init                 # ./<name>/SKILL.md with YAML frontmatter
+skillsauth init --plugin        # Claude + Cursor plugin layout + skills/
 ```
 
-Options:
-- `-g, --global` — Remove from global install
-- `-y, --yes` — Skip confirmation
+### `skillsauth agents`
 
-## Supported AI Agents
+```bash
+skillsauth agents
+skillsauth agents --json
+```
 
-skillsauth automatically detects and installs to:
+---
+
+## Supported agents
+
+Agent IDs and install paths match  (open agent skills ecosystem). skillsauth writes to the same project and global locations.
+
+skillsauth keeps a **canonical** copy under `.agents/skills/<slug>/` (project) or `~/.agents/skills/<slug>/` (global) and symlinks into each tool’s directory when that path differs. Use `--copy` to duplicate files instead of symlinks.
+
+| Agent | `--agent` | Project path | Global path |
+|-------|-----------|----------------|-------------|
+| Amp, Kimi Code CLI, Replit, Universal | `amp`, `kimi-cli`, `replit`, `universal` | `.agents/skills/` | `~/.config/agents/skills/` |
+| Antigravity | `antigravity` | `.agents/skills/` | `~/.gemini/antigravity/skills/` |
+| Augment | `augment` | `.augment/skills/` | `~/.augment/skills/` |
+| Claude Code | `claude-code` | `.claude/skills/` | `~/.claude/skills/` |
+| OpenClaw | `openclaw` | `skills/` | `~/.openclaw/skills/` |
+| Cline, Warp | `cline`, `warp` | `.agents/skills/` | `~/.agents/skills/` |
+| CodeBuddy | `codebuddy` | `.codebuddy/skills/` | `~/.codebuddy/skills/` |
+| Codex | `codex` | `.agents/skills/` | `~/.codex/skills/` |
+| Command Code | `command-code` | `.commandcode/skills/` | `~/.commandcode/skills/` |
+| Continue | `continue` | `.continue/skills/` | `~/.continue/skills/` |
+| Cortex Code | `cortex` | `.cortex/skills/` | `~/.snowflake/cortex/skills/` |
+| Crush | `crush` | `.crush/skills/` | `~/.config/crush/skills/` |
+| Cursor | `cursor` | `.agents/skills/` | `~/.cursor/skills/` |
+| Deep Agents | `deepagents` | `.agents/skills/` | `~/.deepagents/agent/skills/` |
+| Droid | `droid` | `.factory/skills/` | `~/.factory/skills/` |
+| Firebender | `firebender` | `.agents/skills/` | `~/.firebender/skills/` |
+| Gemini CLI | `gemini-cli` | `.agents/skills/` | `~/.gemini/skills/` |
+| GitHub Copilot | `github-copilot` | `.agents/skills/` | `~/.copilot/skills/` |
+| Goose | `goose` | `.goose/skills/` | `~/.config/goose/skills/` |
+| Junie | `junie` | `.junie/skills/` | `~/.junie/skills/` |
+| iFlow CLI | `iflow-cli` | `.iflow/skills/` | `~/.iflow/skills/` |
+| Kilo Code | `kilo` | `.kilocode/skills/` | `~/.kilocode/skills/` |
+| Kiro CLI | `kiro-cli` | `.kiro/skills/` | `~/.kiro/skills/` |
+| Kode | `kode` | `.kode/skills/` | `~/.kode/skills/` |
+| MCPJam | `mcpjam` | `.mcpjam/skills/` | `~/.mcpjam/skills/` |
+| Mistral Vibe | `mistral-vibe` | `.vibe/skills/` | `~/.vibe/skills/` |
+| Mux | `mux` | `.mux/skills/` | `~/.mux/skills/` |
+| OpenCode | `opencode` | `.agents/skills/` | `~/.config/opencode/skills/` |
+| OpenHands | `openhands` | `.openhands/skills/` | `~/.openhands/skills/` |
+| Pi | `pi` | `.pi/skills/` | `~/.pi/agent/skills/` |
+| Qoder | `qoder` | `.qoder/skills/` | `~/.qoder/skills/` |
+| Qwen Code | `qwen-code` | `.qwen/skills/` | `~/.qwen/skills/` |
+| Roo Code | `roo` | `.roo/skills/` | `~/.roo/skills/` |
+| Trae | `trae` | `.trae/skills/` | `~/.trae/skills/` |
+| Trae CN | `trae-cn` | `.trae/skills/` | `~/.trae-cn/skills/` |
+| Windsurf | `windsurf` | `.windsurf/skills/` | `~/.codeium/windsurf/skills/` |
+| Zencoder | `zencoder` | `.zencoder/skills/` | `~/.zencoder/skills/` |
+| Neovate | `neovate` | `.neovate/skills/` | `~/.neovate/skills/` |
+| Pochi | `pochi` | `.pochi/skills/` | `~/.pochi/skills/` |
+| AdaL | `adal` | `.adal/skills/` | `~/.adal/skills/` |
+
+**Kiro CLI:** After installing skills, add them to your custom agent’s `resources` in `.kiro/agents/<agent>.json`:
+
+```json
+{
+  "resources": ["skill://.kiro/skills/**/SKILL.md"]
+}
+```
 
-| Agent | Local Path | Global Path |
-|-------|------------|-------------|
-| Claude Code | `.claude/skills/` | `~/.claude/skills/` |
-| Cursor | `.cursor/skills/` | `~/.cursor/skills/` |
-| Windsurf | `.windsurf/memories/` | `~/.windsurf/memories/` |
+Run `skillsauth agents` or `skillsauth agents --json` for the full ID list.
+
+---
+
+## Plugin authoring
+
+Create plugins that work across Claude Code, Cursor, and the same agent paths as above:
+
+```bash
+skillsauth init --plugin
+```
+
+```
+my-plugin/
+├── .claude-plugin/plugin.json   # Claude Code manifest
+├── .cursor-plugin/plugin.json   # Cursor manifest
+├── skills/
+│   └── my-skill/
+│       └── SKILL.md
+└── README.md
+```
+
+---
 
 ## Security
 
-All skills on SkillsAuth are:
-- ✓ Scanned with mcp-scan
-- ✓ Analyzed with Semgrep
-- ✓ Verified by VirusTotal
+All skills on SkillsAuth are verified before installation:
+
+- **mcp-scan** — prompt injection and tool poisoning checks
+- **Semgrep** — static analysis
+- **VirusTotal** — malware scanning
+- **More scanners** — integrated over time
+
+Skills that fail any scan are **quarantined** and cannot be installed. The CLI warns you if an installed skill becomes quarantined during `update` or `check`.
 
-Skills that fail security scans are quarantined and cannot be installed.
+---
 
-## Environment Variables
+## Environment variables
 
-| Variable | Description |
-|----------|-------------|
-| `SKILLSAUTH_API_URL` | API base URL (default: https://skillsauth.com/api/cli) |
-| `SKILLSAUTH_YES` | Set to `true` to skip all prompts |
-| `SKILLSAUTH_NO_ANALYTICS` | Set to `true` to disable download tracking |
-| `SKILLSAUTH_DEBUG` | Set to `true` for verbose output |
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `SKILLSAUTH_API_URL` | API base URL | `https://skillsauth.com/api/cli` |
+| `SKILLSAUTH_YES` | Skip all prompts | `false` |
+| `SKILLSAUTH_NO_ANALYTICS` | Disable download tracking | `false` |
+| `SKILLSAUTH_DEBUG` | Verbose HTTP logging | `false` |
 
-**Breaking change:** Older `SKILLSAI_*` environment variables are no longer read. Rename them to the `SKILLSAUTH_*` names above.
+---
 
 ## Lockfile
 
-skillsauth maintains a lockfile to track installed skills:
-- Local: `.skillsauth-lock.json` (in project root)
-- Global: `~/.skillsauth/lock.json`
+| Scope | Path |
+|-------|------|
+| Local | `.skillsauth-lock.json` |
+| Global | `~/.skillsauth/lock.json` |
 
-**Breaking change:** Previous paths (`.skillsai-lock.json`, `~/.skillsai/lock.json`) are not used. To keep existing lock state, copy or rename those files to the new locations; otherwise the CLI starts with an empty lock and you can reinstall skills as needed.
+---
 
 ## License
 

package/dist/__tests__/agents.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agents.test.d.ts.map

package/dist/__tests__/agents.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/agents.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/agents.test.js

@@ -0,0 +1,48 @@
+import { describe, it, expect } from 'vitest';
+import { AGENT_IDS } from '../types.js';
+import { AGENT_PATHS } from '../utils/constants.js';
+import { detectAgents, getDisplayName, getAgentMeta } from '../lib/agents.js';
+describe('Agent registry', () => {
+    it('AGENT_IDS contains at least 35 agents', () => {
+        expect(AGENT_IDS.length).toBeGreaterThanOrEqual(35);
+    });
+    it('every agent ID has a path definition', () => {
+        for (const id of AGENT_IDS) {
+            expect(AGENT_PATHS[id]).toBeDefined();
+            expect(typeof AGENT_PATHS[id].local).toBe('function');
+            expect(typeof AGENT_PATHS[id].global).toBe('function');
+        }
+    });
+    it('local paths are project-relative (dot-dir or skills/)', () => {
+        for (const id of AGENT_IDS) {
+            const p = AGENT_PATHS[id].local('test-slug');
+            expect(p.startsWith('.') || p.startsWith('skills/')).toBe(true);
+        }
+    });
+    it('global paths are absolute (contain homedir)', () => {
+        for (const id of AGENT_IDS) {
+            const p = AGENT_PATHS[id].global('test-slug');
+            expect(p.length).toBeGreaterThan(10);
+        }
+    });
+    it('every agent has a display name', () => {
+        for (const id of AGENT_IDS) {
+            expect(getDisplayName(id).length).toBeGreaterThan(0);
+        }
+    });
+    it('getAgentMeta returns id + dotDir + displayName', () => {
+        const meta = getAgentMeta('cursor');
+        expect(meta.id).toBe('cursor');
+        expect(meta.dotDir).toBe('.cursor');
+        expect(meta.displayName).toBe('Cursor');
+    });
+    it('detectAgents returns all agents', () => {
+        const agents = detectAgents('local', process.cwd());
+        expect(agents.length).toBe(AGENT_IDS.length);
+        agents.forEach((a) => {
+            expect(a.name.length).toBeGreaterThan(0);
+            expect(typeof a.detected).toBe('boolean');
+        });
+    });
+});
+//# sourceMappingURL=agents.test.js.map

package/dist/__tests__/agents.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.test.js","sourceRoot":"","sources":["../../src/__tests__/agents.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE9E,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtD,MAAM,CAAC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC7C,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YACnB,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/installer.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=installer.test.d.ts.map

package/dist/__tests__/installer.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installer.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/installer.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/installer.test.js

@@ -0,0 +1,126 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdirSync, rmSync, existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { installSkill, uninstallSkill, getInstallPath } from '../lib/installer.js';
+function makeTmpDir() {
+    const d = join(tmpdir(), `skillsauth-test-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`);
+    mkdirSync(d, { recursive: true });
+    return d;
+}
+const fakeSkill = {
+    id: 'test-id',
+    slug: 'test-skill',
+    name: 'Test Skill',
+    description: 'A test skill',
+    version: '1.0.0',
+    sha: 'abc123',
+    repoOwner: 'test',
+    repoName: 'repo',
+    triggerPhrase: 'test',
+    category: 'test',
+    stars: 0,
+    scanStatus: 'clean',
+    scannedAt: null,
+    files: [
+        { path: 'SKILL.md', content: '# Test\nHello world' },
+        { path: 'scripts/run.sh', content: '#!/bin/bash\necho hello' },
+    ],
+};
+describe('installer', () => {
+    let tmpDir;
+    let origCwd;
+    beforeEach(() => {
+        tmpDir = makeTmpDir();
+        origCwd = process.cwd();
+        process.chdir(tmpDir);
+    });
+    afterEach(() => {
+        process.chdir(origCwd);
+        try {
+            rmSync(tmpDir, { recursive: true, force: true });
+        }
+        catch { /* */ }
+    });
+    it('getInstallPath returns valid path for all agents', () => {
+        const agents = ['claude-code', 'cursor', 'codex', 'universal'];
+        for (const agent of agents) {
+            const p = getInstallPath('my-skill', agent, 'local');
+            expect(p).toContain('my-skill');
+            expect(p).toContain('SKILL.md');
+        }
+    });
+    it('getInstallPath throws on invalid slug', () => {
+        expect(() => getInstallPath('../bad', 'cursor', 'local')).toThrow('Invalid skill slug');
+    });
+    describe('copy mode', () => {
+        it('installs all files to each agent directory', () => {
+            const results = installSkill(fakeSkill, ['cursor', 'claude-code'], 'local', false, true);
+            expect(results).toHaveLength(2);
+            for (const r of results) {
+                expect(r.status).toBe('installed');
+                const dir = join(tmpDir, r.path, '..');
+                expect(existsSync(join(dir, 'SKILL.md'))).toBe(true);
+                expect(readFileSync(join(dir, 'SKILL.md'), 'utf8')).toContain('# Test');
+            }
+        });
+        it('installs nested files (scripts/run.sh)', () => {
+            const results = installSkill(fakeSkill, ['cursor'], 'local', false, true);
+            const dir = join(tmpDir, results[0].path, '..');
+            expect(existsSync(join(dir, 'scripts', 'run.sh'))).toBe(true);
+        });
+        it('skips when content unchanged', () => {
+            installSkill(fakeSkill, ['cursor'], 'local', false, true);
+            const r2 = installSkill(fakeSkill, ['cursor'], 'local', false, true);
+            expect(r2[0].status).toBe('skipped');
+        });
+    });
+    describe('symlink mode', () => {
+        it('writes to canonical .agents/skills/ and symlinks agent-specific dirs', () => {
+            const results = installSkill(fakeSkill, ['claude-code', 'roo'], 'local');
+            expect(results).toHaveLength(2);
+            const canonicalDir = join(tmpDir, '.agents', 'skills', 'test-skill');
+            expect(existsSync(join(canonicalDir, 'SKILL.md'))).toBe(true);
+            const claudeResult = results.find((r) => r.agent === 'claude-code');
+            expect(claudeResult.status).toBe('installed');
+        });
+    });
+    describe('path traversal prevention', () => {
+        it('skips files with .. in path', () => {
+            const malicious = {
+                ...fakeSkill,
+                files: [
+                    { path: '../../../etc/passwd', content: 'pwned' },
+                    { path: 'SKILL.md', content: '# Safe' },
+                ],
+            };
+            installSkill(malicious, ['cursor'], 'local', false, true);
+            expect(existsSync(join(tmpDir, '..', '..', '..', 'etc', 'passwd'))).toBe(false);
+        });
+        it('skips absolute paths', () => {
+            const malicious = {
+                ...fakeSkill,
+                files: [
+                    { path: '/etc/passwd', content: 'pwned' },
+                    { path: 'SKILL.md', content: '# Safe' },
+                ],
+            };
+            installSkill(malicious, ['cursor'], 'local', false, true);
+        });
+    });
+    describe('uninstall', () => {
+        it('removes skill directory for each agent', () => {
+            installSkill(fakeSkill, ['roo', 'claude-code'], 'local', false, true);
+            uninstallSkill('test-skill', ['roo', 'claude-code'], 'local');
+            expect(existsSync(join(tmpDir, '.roo', 'skills', 'test-skill'))).toBe(false);
+            expect(existsSync(join(tmpDir, '.claude', 'skills', 'test-skill'))).toBe(false);
+        });
+        it('silently handles non-existent skill', () => {
+            expect(() => uninstallSkill('nonexistent', ['cursor'], 'local')).not.toThrow();
+        });
+        it('rejects unsafe slugs', () => {
+            expect(() => uninstallSkill('../bad', ['cursor'], 'local')).not.toThrow();
+        });
+    });
+});
+//# sourceMappingURL=installer.test.js.map

package/dist/__tests__/installer.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installer.test.js","sourceRoot":"","sources":["../../src/__tests__/installer.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAa,MAAM,IAAI,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGnF,SAAS,UAAU;IACjB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACpG,SAAS,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,SAAS,GAAa;IAC1B,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,cAAc;IAC3B,OAAO,EAAE,OAAO;IAChB,GAAG,EAAE,QAAQ;IACb,SAAS,EAAE,MAAM;IACjB,QAAQ,EAAE,MAAM;IAChB,aAAa,EAAE,MAAM;IACrB,QAAQ,EAAE,MAAM;IAChB,KAAK,EAAE,CAAC;IACR,UAAU,EAAE,OAAO;IACnB,SAAS,EAAE,IAAI;IACf,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,qBAAqB,EAAE;QACpD,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,yBAAyB,EAAE;KAC/D;CACF,CAAC;AAEF,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,IAAI,MAAc,CAAC;IACnB,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,UAAU,EAAE,CAAC;QACtB,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,CAAC;YAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAgB,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QAC5E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAChC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACzF,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACnC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACvC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrD,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1D,MAAM,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACrE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;YAC9E,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YACzE,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAEhC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;YACrE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAE9D,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,aAAa,CAAE,CAAC;YACrE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,MAAM,SAAS,GAAa;gBAC1B,GAAG,SAAS;gBACZ,KAAK,EAAE;oBACL,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE;oBACjD,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE;iBACxC;aACF,CAAC;YACF,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1D,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,SAAS,GAAa;gBAC1B,GAAG,SAAS;gBACZ,KAAK,EAAE;oBACL,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE;oBACzC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE;iBACxC;aACF,CAAC;YACF,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,YAAY,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACtE,cAAc,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;YAC9D,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7E,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/lockfile.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=lockfile.test.d.ts.map

package/dist/__tests__/lockfile.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/lockfile.test.ts"],"names":[],"mappings":""}