skillsets 0.1.0

package/dist/commands/submit.js

@@ -0,0 +1,292 @@
+import chalk from 'chalk';
+import ora from 'ora';
+import { execSync } from 'child_process';
+import { existsSync, readFileSync, mkdirSync, cpSync, rmSync } from 'fs';
+import { join } from 'path';
+import yaml from 'js-yaml';
+import { tmpdir } from 'os';
+import { fetchSkillsetMetadata } from '../lib/api.js';
+const REGISTRY_REPO = 'skillsets-cc/main';
+/**
+ * Compare semver versions. Returns:
+ * -1 if a < b, 0 if a == b, 1 if a > b
+ */
+function compareVersions(a, b) {
+    const partsA = a.split('.').map(Number);
+    const partsB = b.split('.').map(Number);
+    for (let i = 0; i < 3; i++) {
+        const numA = partsA[i] || 0;
+        const numB = partsB[i] || 0;
+        if (numA < numB)
+            return -1;
+        if (numA > numB)
+            return 1;
+    }
+    return 0;
+}
+const REGISTRY_URL = `https://github.com/${REGISTRY_REPO}`;
+function checkGhCli() {
+    try {
+        execSync('gh --version', { stdio: 'ignore' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function checkGhAuth() {
+    try {
+        execSync('gh auth status', { stdio: 'ignore' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function getGhUsername() {
+    try {
+        const result = execSync('gh api user --jq .login', { encoding: 'utf-8' });
+        return result.trim();
+    }
+    catch {
+        return null;
+    }
+}
+function parseSkillsetYaml(cwd) {
+    const yamlPath = join(cwd, 'skillset.yaml');
+    if (!existsSync(yamlPath))
+        return null;
+    try {
+        const content = readFileSync(yamlPath, 'utf-8');
+        const data = yaml.load(content);
+        return {
+            name: data.name,
+            author: data.author?.handle?.replace('@', ''),
+            version: data.version,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function checkAuditReport(cwd) {
+    const reportPath = join(cwd, 'AUDIT_REPORT.md');
+    if (!existsSync(reportPath)) {
+        return { exists: false, passing: false };
+    }
+    const content = readFileSync(reportPath, 'utf-8');
+    const passing = content.includes('READY FOR SUBMISSION');
+    return { exists: true, passing };
+}
+export async function submit() {
+    const cwd = process.cwd();
+    console.log(chalk.blue('\n📤 Submit skillset to registry\n'));
+    // Pre-flight checks
+    console.log(chalk.gray('Running pre-flight checks...\n'));
+    // 1. Check gh CLI
+    if (!checkGhCli()) {
+        console.log(chalk.red('✗ GitHub CLI (gh) not found'));
+        console.log(chalk.gray('  Install: https://cli.github.com/'));
+        process.exit(1);
+    }
+    console.log(chalk.green('✓ GitHub CLI found'));
+    // 2. Check gh auth
+    if (!checkGhAuth()) {
+        console.log(chalk.red('✗ GitHub CLI not authenticated'));
+        console.log(chalk.gray('  Run: gh auth login'));
+        process.exit(1);
+    }
+    console.log(chalk.green('✓ GitHub CLI authenticated'));
+    // 3. Get username
+    const username = getGhUsername();
+    if (!username) {
+        console.log(chalk.red('✗ Could not determine GitHub username'));
+        process.exit(1);
+    }
+    console.log(chalk.green(`✓ Logged in as ${username}`));
+    // 4. Check skillset.yaml
+    const skillset = parseSkillsetYaml(cwd);
+    if (!skillset) {
+        console.log(chalk.red('✗ skillset.yaml not found or invalid'));
+        console.log(chalk.gray('  Run: npx skillsets init'));
+        process.exit(1);
+    }
+    console.log(chalk.green(`✓ Skillset: ${skillset.name} v${skillset.version}`));
+    // 5. Check audit report
+    const audit = checkAuditReport(cwd);
+    if (!audit.exists) {
+        console.log(chalk.red('✗ AUDIT_REPORT.md not found'));
+        console.log(chalk.gray('  Run: npx skillsets audit'));
+        process.exit(1);
+    }
+    if (!audit.passing) {
+        console.log(chalk.red('✗ Audit report shows failures'));
+        console.log(chalk.gray('  Fix issues and re-run: npx skillsets audit'));
+        process.exit(1);
+    }
+    console.log(chalk.green('✓ Audit report passing'));
+    // 6. Check required files
+    const requiredFiles = ['skillset.yaml', 'README.md', 'PROOF.md', 'AUDIT_REPORT.md', 'content'];
+    for (const file of requiredFiles) {
+        if (!existsSync(join(cwd, file))) {
+            console.log(chalk.red(`✗ Missing required: ${file}`));
+            process.exit(1);
+        }
+    }
+    console.log(chalk.green('✓ All required files present'));
+    // 7. Check if this is an update
+    const skillsetId = `@${skillset.author}/${skillset.name}`;
+    let isUpdate = false;
+    let existingVersion = null;
+    let registryAvailable = true;
+    try {
+        const existing = await fetchSkillsetMetadata(skillsetId);
+        if (existing) {
+            isUpdate = true;
+            existingVersion = existing.version;
+        }
+    }
+    catch {
+        // Registry unavailable, assume new submission
+        registryAvailable = false;
+    }
+    // Validate version bump (outside try-catch so process.exit works in tests)
+    if (isUpdate && existingVersion) {
+        if (compareVersions(skillset.version, existingVersion) <= 0) {
+            console.log(chalk.red(`✗ Version must be greater than ${existingVersion}`));
+            console.log(chalk.gray(`  Current: ${skillset.version}`));
+            console.log(chalk.gray('  Update skillset.yaml with a higher version'));
+            process.exit(1);
+        }
+        console.log(chalk.green(`✓ Update: ${existingVersion} → ${skillset.version}`));
+    }
+    else if (registryAvailable) {
+        console.log(chalk.green('✓ New skillset submission'));
+    }
+    else {
+        console.log(chalk.yellow('⚠ Could not check registry (assuming new submission)'));
+    }
+    console.log('');
+    // Create submission
+    const spinner = ora('Preparing submission...').start();
+    const branchName = `submit/${skillset.author}/${skillset.name}`;
+    const tempDir = join(tmpdir(), `skillsets-submit-${Date.now()}`);
+    try {
+        // Fork and clone
+        spinner.text = 'Forking registry (if needed)...';
+        try {
+            execSync(`gh repo fork ${REGISTRY_REPO} --clone=false`, { stdio: 'ignore' });
+        }
+        catch {
+            // Already forked, that's fine
+        }
+        // Clone the fork
+        spinner.text = 'Cloning registry...';
+        execSync(`gh repo clone ${REGISTRY_REPO} "${tempDir}" -- --depth=1`, { stdio: 'ignore' });
+        // Create branch
+        spinner.text = 'Creating branch...';
+        execSync(`git checkout -b "${branchName}"`, { cwd: tempDir, stdio: 'ignore' });
+        // Create skillset directory
+        const skillsetDir = join(tempDir, 'skillsets', `@${skillset.author}`, skillset.name);
+        mkdirSync(skillsetDir, { recursive: true });
+        // Copy files
+        spinner.text = 'Copying skillset files...';
+        const filesToCopy = ['skillset.yaml', 'README.md', 'PROOF.md', 'AUDIT_REPORT.md', 'content'];
+        for (const file of filesToCopy) {
+            const src = join(cwd, file);
+            const dest = join(skillsetDir, file);
+            cpSync(src, dest, { recursive: true });
+        }
+        // Commit
+        spinner.text = 'Committing changes...';
+        execSync('git add .', { cwd: tempDir, stdio: 'ignore' });
+        const commitMsg = isUpdate
+            ? `Update ${skillsetId} to v${skillset.version}`
+            : `Add ${skillsetId}`;
+        execSync(`git commit -m "${commitMsg}"`, { cwd: tempDir, stdio: 'ignore' });
+        // Push to fork
+        spinner.text = 'Pushing to fork...';
+        execSync(`git push -u origin "${branchName}" --force`, { cwd: tempDir, stdio: 'ignore' });
+        // Create PR
+        spinner.text = 'Creating pull request...';
+        const prTitle = isUpdate
+            ? `Update ${skillsetId} to v${skillset.version}`
+            : `Add ${skillsetId}`;
+        const prBody = isUpdate
+            ? `## Skillset Update
+
+**Skillset:** ${skillsetId}
+**Version:** ${existingVersion} → ${skillset.version}
+**Author:** @${skillset.author}
+
+### Checklist
+
+- [x] \`skillset.yaml\` validated against schema
+- [x] Version bumped from ${existingVersion}
+- [x] \`AUDIT_REPORT.md\` generated and passing
+- [x] \`content/\` directory updated
+
+### Changes
+
+_Describe what changed in this version._
+
+---
+Submitted via \`npx skillsets submit\`
+`
+            : `## New Skillset Submission
+
+**Skillset:** ${skillsetId}
+**Version:** ${skillset.version}
+**Author:** @${skillset.author}
+
+### Checklist
+
+- [x] \`skillset.yaml\` validated against schema
+- [x] \`README.md\` with installation and usage instructions
+- [x] \`PROOF.md\` with production evidence
+- [x] \`AUDIT_REPORT.md\` generated and passing
+- [x] \`content/\` directory with skillset files
+
+### Notes
+
+_Add any additional context for reviewers here._
+
+---
+Submitted via \`npx skillsets submit\`
+`;
+        const prResult = execSync(`gh pr create --repo ${REGISTRY_REPO} --title "${prTitle}" --body "${prBody.replace(/"/g, '\\"')}"`, { cwd: tempDir, encoding: 'utf-8' });
+        // Cleanup
+        spinner.text = 'Cleaning up...';
+        rmSync(tempDir, { recursive: true, force: true });
+        spinner.succeed('Pull request created');
+        // Extract PR URL from result
+        const prUrl = prResult.trim();
+        console.log(chalk.green(`\n✓ ${isUpdate ? 'Update' : 'Submission'} complete!\n`));
+        console.log(`  Skillset: ${chalk.bold(skillsetId)}`);
+        if (isUpdate) {
+            console.log(`  Version: ${chalk.gray(existingVersion)} → ${chalk.bold(skillset.version)}`);
+        }
+        else {
+            console.log(`  Version: ${chalk.bold(skillset.version)}`);
+        }
+        console.log(`  PR: ${chalk.cyan(prUrl)}`);
+        console.log('');
+        console.log(chalk.gray('A maintainer will review your submission.'));
+        console.log(chalk.gray('You can track progress at the PR link above.'));
+    }
+    catch (error) {
+        spinner.fail('Submission failed');
+        console.log(chalk.red('\nError details:'));
+        console.log(chalk.gray(error.message || error));
+        // Cleanup on error
+        if (existsSync(tempDir)) {
+            rmSync(tempDir, { recursive: true, force: true });
+        }
+        console.log(chalk.cyan('\nTo submit manually:'));
+        console.log(`  1. Fork ${REGISTRY_URL}`);
+        console.log(`  2. Create skillsets/@${skillset.author}/${skillset.name}/`);
+        console.log('  3. Copy your skillset files');
+        console.log('  4. Open a pull request');
+        process.exit(1);
+    }
+}

package/dist/commands/verify.d.ts

@@ -0,0 +1,5 @@
+interface VerifyOptions {
+    dir?: string;
+}
+export declare function verify(options: VerifyOptions): Promise<void>;
+export {};

package/dist/commands/verify.js

@@ -0,0 +1,31 @@
+import chalk from 'chalk';
+import ora from 'ora';
+import { verifyChecksums } from '../lib/checksum.js';
+import { detectSkillset } from '../lib/filesystem.js';
+export async function verify(options) {
+    const dir = options.dir || process.cwd();
+    const spinner = ora('Detecting skillset...').start();
+    // Detect which skillset is installed
+    const skillsetId = await detectSkillset(dir);
+    if (!skillsetId) {
+        spinner.fail('No skillset.yaml found in directory');
+        throw new Error('No skillset.yaml found in directory');
+    }
+    spinner.text = `Verifying ${skillsetId}...`;
+    // Verify checksums
+    const result = await verifyChecksums(skillsetId, dir);
+    if (result.valid) {
+        spinner.succeed('All checksums match!');
+        return;
+    }
+    spinner.fail('Checksum verification failed');
+    console.log(chalk.yellow('\nMismatched files:'));
+    result.mismatches.forEach(({ file, expected, actual }) => {
+        console.log(`  ${chalk.red('✗')} ${file}`);
+        console.log(`    Expected: ${expected}`);
+        console.log(`    Actual:   ${actual}`);
+    });
+    console.log(chalk.cyan('\nTo fix:'));
+    console.log(`  npx skillsets install ${skillsetId} --force`);
+    throw new Error('Checksum verification failed');
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+import { program } from 'commander';
+import { search } from './commands/search.js';
+import { list } from './commands/list.js';
+import { install } from './commands/install.js';
+import { verify } from './commands/verify.js';
+import { init } from './commands/init.js';
+import { audit } from './commands/audit.js';
+import { submit } from './commands/submit.js';
+import { handleError } from './lib/errors.js';
+program
+    .name('skillsets')
+    .description('CLI tool for discovering and installing verified skillsets')
+    .version('0.1.0');
+// === Discovery Commands ===
+program
+    .command('list')
+    .description('List all available skillsets')
+    .option('-l, --limit <number>', 'Limit results')
+    .option('-s, --sort <field>', 'Sort by: name, stars (default: name)')
+    .option('--json', 'Output as JSON')
+    .action(async (options) => {
+    try {
+        await list(options);
+    }
+    catch (error) {
+        handleError(error);
+    }
+});
+program
+    .command('search')
+    .description('Search for skillsets by name, description, or tags')
+    .argument('<query>', 'Search query')
+    .option('-t, --tags <tags...>', 'Filter by tags')
+    .option('-l, --limit <number>', 'Limit results (default: 10)', '10')
+    .action(async (query, options) => {
+    try {
+        await search(query, options);
+    }
+    catch (error) {
+        handleError(error);
+    }
+});
+program
+    .command('install')
+    .description('Install a skillset to the current directory')
+    .argument('<skillsetId>', 'Skillset ID (e.g., @user/skillset-name)')
+    .option('-f, --force', 'Overwrite existing files')
+    .option('-b, --backup', 'Backup existing files before install')
+    .action(async (skillsetId, options) => {
+    try {
+        await install(skillsetId, options);
+    }
+    catch (error) {
+        handleError(error);
+    }
+});
+program
+    .command('verify')
+    .description('Verify installed skillset checksums against registry')
+    .option('-d, --dir <path>', 'Directory to verify (default: current)', '.')
+    .action(async (options) => {
+    try {
+        await verify(options);
+    }
+    catch (error) {
+        handleError(error);
+    }
+});
+// === Contribution Commands ===
+program
+    .command('init')
+    .description('Initialize a new skillset submission')
+    .option('-y, --yes', 'Accept defaults without prompting')
+    .action(async (options) => {
+    try {
+        await init(options);
+    }
+    catch (error) {
+        handleError(error);
+    }
+});
+program
+    .command('audit')
+    .description('Validate skillset and generate audit report')
+    .action(async () => {
+    try {
+        await audit();
+    }
+    catch (error) {
+        handleError(error);
+    }
+});
+program
+    .command('submit')
+    .description('Submit skillset to registry via GitHub PR')
+    .action(async () => {
+    try {
+        await submit();
+    }
+    catch (error) {
+        handleError(error);
+    }
+});
+program.parse();

package/dist/lib/api.d.ts

@@ -0,0 +1,10 @@
+import type { SearchIndex, SearchIndexEntry } from '../types/index.js';
+/**
+ * Fetches the search index from the CDN.
+ * Implements 1-hour local cache to reduce network requests.
+ */
+export declare function fetchSearchIndex(): Promise<SearchIndex>;
+/**
+ * Fetches metadata for a specific skillset by ID.
+ */
+export declare function fetchSkillsetMetadata(skillsetId: string): Promise<SearchIndexEntry | undefined>;

package/dist/lib/api.js

@@ -0,0 +1,29 @@
+import { SEARCH_INDEX_URL, CACHE_TTL_MS } from './constants.js';
+let cachedIndex = null;
+let cacheTime = 0;
+/**
+ * Fetches the search index from the CDN.
+ * Implements 1-hour local cache to reduce network requests.
+ */
+export async function fetchSearchIndex() {
+    const now = Date.now();
+    // Return cached if still valid
+    if (cachedIndex && now - cacheTime < CACHE_TTL_MS) {
+        return cachedIndex;
+    }
+    const response = await fetch(SEARCH_INDEX_URL);
+    if (!response.ok) {
+        throw new Error(`Failed to fetch search index: ${response.statusText}`);
+    }
+    const data = (await response.json());
+    cachedIndex = data;
+    cacheTime = now;
+    return data;
+}
+/**
+ * Fetches metadata for a specific skillset by ID.
+ */
+export async function fetchSkillsetMetadata(skillsetId) {
+    const index = await fetchSearchIndex();
+    return index.skillsets.find((s) => s.id === skillsetId);
+}

package/dist/lib/checksum.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Computes SHA-256 checksum for a file.
+ */
+export declare function computeFileChecksum(filePath: string): Promise<string>;
+/**
+ * Verifies checksums of installed skillset against registry.
+ * Returns validation result with list of mismatches.
+ */
+export declare function verifyChecksums(skillsetId: string, dir: string): Promise<{
+    valid: boolean;
+    mismatches: Array<{
+        file: string;
+        expected: string;
+        actual: string;
+    }>;
+}>;

package/dist/lib/checksum.js

@@ -0,0 +1,53 @@
+import * as crypto from 'crypto';
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { fetchSkillsetMetadata } from './api.js';
+/**
+ * Computes SHA-256 checksum for a file.
+ */
+export async function computeFileChecksum(filePath) {
+    const content = await fs.readFile(filePath, 'utf-8');
+    return crypto.createHash('sha256').update(content).digest('hex');
+}
+/**
+ * Verifies checksums of installed skillset against registry.
+ * Returns validation result with list of mismatches.
+ */
+/**
+ * Strips algorithm prefix from checksum (e.g., "sha256:abc123" -> "abc123").
+ */
+function stripChecksumPrefix(checksum) {
+    const colonIndex = checksum.indexOf(':');
+    return colonIndex !== -1 ? checksum.slice(colonIndex + 1) : checksum;
+}
+/**
+ * Verifies checksums of installed skillset against registry.
+ * Returns validation result with list of mismatches.
+ */
+export async function verifyChecksums(skillsetId, dir) {
+    const metadata = await fetchSkillsetMetadata(skillsetId);
+    if (!metadata) {
+        throw new Error(`Skillset ${skillsetId} not found in registry`);
+    }
+    const mismatches = [];
+    for (const [file, expectedChecksum] of Object.entries(metadata.files)) {
+        const filePath = path.join(dir, file);
+        try {
+            const actualChecksum = await computeFileChecksum(filePath);
+            // Strip sha256: prefix from expected checksum for comparison
+            const expectedHex = stripChecksumPrefix(expectedChecksum);
+            if (actualChecksum !== expectedHex) {
+                mismatches.push({ file, expected: expectedHex, actual: actualChecksum });
+            }
+        }
+        catch (error) {
+            // File missing or unreadable
+            mismatches.push({
+                file,
+                expected: stripChecksumPrefix(expectedChecksum),
+                actual: 'MISSING',
+            });
+        }
+    }
+    return { valid: mismatches.length === 0, mismatches };
+}

package/dist/lib/constants.d.ts

@@ -0,0 +1,6 @@
+export declare const CDN_BASE_URL = "https://skillsets.cc";
+export declare const SEARCH_INDEX_URL = "https://skillsets.cc/search-index.json";
+export declare const REGISTRY_REPO = "skillsets-cc/main";
+export declare const CACHE_TTL_MS: number;
+export declare const DEFAULT_SEARCH_LIMIT = 10;
+export declare const BACKUP_DIR_NAME = ".claude.backup";

package/dist/lib/constants.js

@@ -0,0 +1,6 @@
+export const CDN_BASE_URL = 'https://skillsets.cc';
+export const SEARCH_INDEX_URL = `${CDN_BASE_URL}/search-index.json`;
+export const REGISTRY_REPO = 'skillsets-cc/main';
+export const CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
+export const DEFAULT_SEARCH_LIMIT = 10;
+export const BACKUP_DIR_NAME = '.claude.backup';

package/dist/lib/errors.d.ts

@@ -0,0 +1 @@
+export declare function handleError(error: unknown): void;

package/dist/lib/errors.js

@@ -0,0 +1,11 @@
+import chalk from 'chalk';
+export function handleError(error) {
+    if (error instanceof Error) {
+        console.error(chalk.red(`Error: ${error.message}`));
+    }
+    else {
+        console.error(chalk.red('Unexpected error:'));
+        console.error(error);
+    }
+    process.exit(1);
+}

package/dist/lib/filesystem.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Detects conflicts with existing files that would be overwritten during installation.
+ */
+export declare function detectConflicts(dir: string): Promise<string[]>;
+/**
+ * Backs up existing files to .claude.backup directory.
+ */
+export declare function backupFiles(files: string[], dir: string): Promise<void>;
+/**
+ * Detects which skillset is installed in the given directory.
+ * Returns the skillset ID or null if not found.
+ */
+export declare function detectSkillset(dir: string): Promise<string | null>;

package/dist/lib/filesystem.js

@@ -0,0 +1,75 @@
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import yaml from 'js-yaml';
+import { BACKUP_DIR_NAME } from './constants.js';
+const CONFLICT_CHECK_PATHS = ['.claude/', 'CLAUDE.md', 'skillset.yaml'];
+/**
+ * Detects conflicts with existing files that would be overwritten during installation.
+ */
+export async function detectConflicts(dir) {
+    const conflicts = [];
+    for (const checkPath of CONFLICT_CHECK_PATHS) {
+        const fullPath = path.join(dir, checkPath);
+        try {
+            await fs.access(fullPath);
+            conflicts.push(checkPath);
+        }
+        catch {
+            // File doesn't exist, no conflict
+        }
+    }
+    return conflicts;
+}
+/**
+ * Backs up existing files to .claude.backup directory.
+ */
+export async function backupFiles(files, dir) {
+    const backupDir = path.join(dir, BACKUP_DIR_NAME);
+    await fs.mkdir(backupDir, { recursive: true });
+    for (const file of files) {
+        const src = path.join(dir, file);
+        const dest = path.join(backupDir, file);
+        // Create parent directories
+        await fs.mkdir(path.dirname(dest), { recursive: true });
+        // Copy file or directory recursively
+        const stats = await fs.stat(src);
+        if (stats.isDirectory()) {
+            await copyDirectory(src, dest);
+        }
+        else {
+            await fs.copyFile(src, dest);
+        }
+    }
+}
+/**
+ * Recursively copies a directory.
+ */
+async function copyDirectory(src, dest) {
+    await fs.mkdir(dest, { recursive: true });
+    const entries = await fs.readdir(src, { withFileTypes: true });
+    for (const entry of entries) {
+        const srcPath = path.join(src, entry.name);
+        const destPath = path.join(dest, entry.name);
+        if (entry.isDirectory()) {
+            await copyDirectory(srcPath, destPath);
+        }
+        else {
+            await fs.copyFile(srcPath, destPath);
+        }
+    }
+}
+/**
+ * Detects which skillset is installed in the given directory.
+ * Returns the skillset ID or null if not found.
+ */
+export async function detectSkillset(dir) {
+    try {
+        const yamlPath = path.join(dir, 'skillset.yaml');
+        const content = await fs.readFile(yamlPath, 'utf-8');
+        const data = yaml.load(content);
+        return `${data.author.handle}/${data.name}`;
+    }
+    catch {
+        return null;
+    }
+}