skillvault 0.11.0 → 0.11.1

package/dist/cli.js

@@ -24,7 +24,7 @@ import { resolveScope, resolveRoots, } from './scope.js';
 import { loadCredentials, saveCredentials, loadProjectConfig, saveProjectConfig, } from './credentials.js';
 import { registerProject, unregisterProject, getCurrentProject, listProjects, } from './projects-registry.js';
 import { confirmInstall } from './prompts.js';
-const VERSION = '0.11.0';
+const VERSION = '0.11.1';
 const HOME = process.env.HOME || process.env.USERPROFILE || '~';
 const API_URL = process.env.SKILLVAULT_API_URL || 'https://api.getskillvault.com';
 const CONFIG_DIR = join(HOME, '.skillvault');
@@ -1242,13 +1242,12 @@ function scrubSkillvaultHooks(settingsPath) {
     return removed;
 }
 /**
- * Walk <roots.claudeDir>/skills/ and remove every stub whose manifest.json
- * has an `encrypted: true` flag (the marker we set during install). Returns
- * the list of removed skill names. Vault data is left in place so a future
- * --invite or migrate can reuse it.
+ * Walk a single skills directory and remove every stub whose manifest.json
+ * has an `encrypted: true` flag or a `publisher_id` (the markers we set during
+ * install). Returns the list of removed skill names. Pre-existing skills from
+ * other tools (no manifest, or non-skillvault manifest) are left untouched.
  */
-function removeAllSkillvaultStubs(roots) {
-    const skillsDir = join(roots.claudeDir, 'skills');
+function removeStubsFromDir(skillsDir) {
     if (!existsSync(skillsDir))
         return [];
     const removed = [];
@@ -1268,6 +1267,68 @@ function removeAllSkillvaultStubs(roots) {
     }
     return removed;
 }
+/**
+ * Walk every directory where install would have written a stub and remove
+ * the SkillVault-managed ones. For project mode this is just
+ * <roots.claudeDir>/skills/. For global mode it also covers ~/.agents/skills/
+ * and the agent-agnostic platform mirrors (Cursor, Windsurf, Codex). Vault
+ * data in <roots.vaultDir> is left in place so a future --invite or
+ * migrate-to-project can reuse it.
+ */
+function removeAllSkillvaultStubs(roots) {
+    const all = [];
+    // Always: <roots.claudeDir>/skills/ (the install's primary stub location)
+    all.push(...removeStubsFromDir(join(roots.claudeDir, 'skills')));
+    // Global only: ~/.agents/skills/ + every detected platform mirror.
+    // installSkillStubs writes to all of these in global mode, so the global
+    // uninstall has to clean all of them up too.
+    if (roots.scope === 'global') {
+        all.push(...removeStubsFromDir(AGENTS_SKILLS_DIR));
+        for (const platform of detectAgentPlatforms()) {
+            all.push(...removeStubsFromDir(platform.dir));
+        }
+    }
+    // Dedupe — the same skill_name can appear in multiple mirrors.
+    return [...new Set(all)];
+}
+/**
+ * Remove SkillVault entries from a shared skill-lock.json file, preserving
+ * any entries that belong to other tools (e.g. skill-creator's
+ * sourceType=github wallet skills coexist with our sourceType=skillvault
+ * entries in ~/.agents/.skill-lock.json). If the file ends up with zero
+ * entries, the whole file is deleted.
+ */
+function pruneSkillvaultLockEntries(lockPath) {
+    if (!existsSync(lockPath))
+        return 0;
+    try {
+        const data = JSON.parse(readFileSync(lockPath, 'utf8'));
+        if (!data.skills || typeof data.skills !== 'object')
+            return 0;
+        let removed = 0;
+        for (const [name, entry] of Object.entries(data.skills)) {
+            if (entry && typeof entry === 'object' && (entry.sourceType === 'skillvault' || entry.encrypted === true)) {
+                delete data.skills[name];
+                removed++;
+            }
+        }
+        if (removed === 0)
+            return 0;
+        if (Object.keys(data.skills).length === 0) {
+            try {
+                rmSync(lockPath);
+            }
+            catch { }
+        }
+        else {
+            writeFileSync(lockPath, JSON.stringify(data, null, 2), { mode: 0o600 });
+        }
+        return removed;
+    }
+    catch {
+        return 0;
+    }
+}
 /**
  * Uninstall a single SkillVault install at the given roots.
  *
@@ -1303,8 +1364,17 @@ function uninstallInstall(roots) {
             catch { }
         }
         else {
-            // Global install — preserve credentials.json + projects.json.
-            const PRESERVE = new Set(['credentials.json', 'projects.json']);
+            // Global install — preserve customer identity + publisher CLI state.
+            // credentials.json + projects.json are the customer-side files we
+            // documented as always-preserved. config.json + grants-cache.json are
+            // owned by the publisher CLI (skillvault-publisher) — the customer-
+            // side uninstall has no business deleting publisher login state.
+            const PRESERVE = new Set([
+                'credentials.json',
+                'projects.json',
+                'config.json', // publisher CLI session
+                'grants-cache.json', // publisher CLI grant cache
+            ]);
             for (const entry of readdirSync(roots.configDir)) {
                 if (PRESERVE.has(entry))
                     continue;
@@ -1317,8 +1387,16 @@ function uninstallInstall(roots) {
             }
         }
     }
-    // Skill stubs in <roots.claudeDir>/skills/
+    // Skill stubs in every location install would have written them: always
+    // <roots.claudeDir>/skills/, and (global mode) ~/.agents/skills/ + each
+    // detected platform mirror.
     summary.removedStubs = removeAllSkillvaultStubs(roots);
+    // Prune SkillVault entries from the shared lock file. In global mode this
+    // is ~/.agents/.skill-lock.json which can also hold non-skillvault entries
+    // (e.g. from skill-creator), so we preserve other entries.
+    if (roots.scope === 'global') {
+        pruneSkillvaultLockEntries(AGENTS_LOCK_PATH);
+    }
     // Hooks in settings.json
     summary.removedHooks = scrubSkillvaultHooks(roots.settingsPath);
     // Registry: drop the entry if this was a project install. Use the install

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillvault",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "SkillVault — secure skill distribution for Claude Code",
   "type": "module",
   "bin": {