skillvault 0.4.0 → 0.5.0

package/dist/cli.d.ts

@@ -1,21 +1,20 @@
 #!/usr/bin/env node
 /**
- * SkillVault Agent — Secure skill distribution for Claude Code.
+ * SkillVault — Secure skill distribution for Claude Code.
  *
  * Usage:
- *   npx skillvault --invite CODE          # Setup / add publisher
+ *   npx skillvault --invite CODE          # Setup: redeem invite + sync + install
+ *   npx skillvault --load SKILL           # Decrypt a skill (used by Claude Code)
  *   npx skillvault --status               # Show publishers & skills
  *   npx skillvault --refresh              # Re-authenticate tokens + sync
- *   npx skillvault --sync                 # Sync vaults + install stubs
- *   npx skillvault                        # Start MCP server (after setup)
+ *   npx skillvault --sync                 # Sync vaults + update stubs
  *
  * How it works:
- *   1. Redeems invite code → gets publisher token
- *   2. Downloads encrypted skill vaults to ~/.skillvault/vaults/
- *   3. Installs stub SKILL.md files in ~/.claude/skills/ (Claude discovers these)
- *   4. Starts MCP server exposing skillvault_load tool
- *   5. When Claude triggers a skill, it calls skillvault_load → decrypts on demand
- *   6. Decrypted content lives only in conversation context — never on disk
- *   7. License is validated on every load — revoked license = dead skill
+ *   1. Customer runs --invite once → vaults downloaded, stubs installed
+ *   2. Claude Code discovers stub SKILL.md files in ~/.claude/skills/
+ *   3. When a skill is triggered, Claude runs: npx skillvault --load <name>
+ *   4. The CLI decrypts the vault (license checked) and outputs to stdout
+ *   5. Claude reads the output and follows the instructions
+ *   6. Decrypted content is never written to disk
  */
 export {};

package/dist/cli.js

@@ -1,31 +1,28 @@
 #!/usr/bin/env node
 /**
- * SkillVault Agent — Secure skill distribution for Claude Code.
+ * SkillVault — Secure skill distribution for Claude Code.
  *
  * Usage:
- *   npx skillvault --invite CODE          # Setup / add publisher
+ *   npx skillvault --invite CODE          # Setup: redeem invite + sync + install
+ *   npx skillvault --load SKILL           # Decrypt a skill (used by Claude Code)
  *   npx skillvault --status               # Show publishers & skills
  *   npx skillvault --refresh              # Re-authenticate tokens + sync
- *   npx skillvault --sync                 # Sync vaults + install stubs
- *   npx skillvault                        # Start MCP server (after setup)
+ *   npx skillvault --sync                 # Sync vaults + update stubs
  *
  * How it works:
- *   1. Redeems invite code → gets publisher token
- *   2. Downloads encrypted skill vaults to ~/.skillvault/vaults/
- *   3. Installs stub SKILL.md files in ~/.claude/skills/ (Claude discovers these)
- *   4. Starts MCP server exposing skillvault_load tool
- *   5. When Claude triggers a skill, it calls skillvault_load → decrypts on demand
- *   6. Decrypted content lives only in conversation context — never on disk
- *   7. License is validated on every load — revoked license = dead skill
+ *   1. Customer runs --invite once → vaults downloaded, stubs installed
+ *   2. Claude Code discovers stub SKILL.md files in ~/.claude/skills/
+ *   3. When a skill is triggered, Claude runs: npx skillvault --load <name>
+ *   4. The CLI decrypts the vault (license checked) and outputs to stdout
+ *   5. Claude reads the output and follows the instructions
+ *   6. Decrypted content is never written to disk
  */
-import { createServer } from 'node:http';
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { createDecipheriv, createPublicKey, diffieHellman, hkdfSync, generateKeyPairSync, } from 'node:crypto';
-const VERSION = '0.4.0';
+const VERSION = '0.5.0';
 const HOME = process.env.HOME || process.env.USERPROFILE || '~';
 const API_URL = process.env.SKILLVAULT_API_URL || 'https://api.getskillvault.com';
-const MCP_PORT = parseInt(process.env.SKILLVAULT_MCP_PORT || '9877', 10);
 const CONFIG_DIR = join(HOME, '.skillvault');
 const CONFIG_PATH = join(CONFIG_DIR, 'agent-config.json');
 const VAULT_DIR = join(CONFIG_DIR, 'vaults');
@@ -34,6 +31,8 @@ const SKILLS_DIR = join(HOME, '.claude', 'skills');
 const args = process.argv.slice(2);
 const inviteIdx = args.indexOf('--invite');
 const inviteCode = inviteIdx >= 0 ? args[inviteIdx + 1] : null;
+const loadIdx = args.indexOf('--load');
+const loadSkillName = loadIdx >= 0 ? args[loadIdx + 1] : null;
 const helpFlag = args.includes('--help') || args.includes('-h');
 const versionFlag = args.includes('--version') || args.includes('-v');
 const statusFlag = args.includes('--status');
@@ -45,24 +44,24 @@ if (versionFlag) {
 }
 if (helpFlag) {
     console.log(`
-  SkillVault — Secure skill distribution for Claude Code
+  SkillVault v${VERSION} — Secure skill distribution for Claude Code
 
   Usage:
-    npx skillvault --invite CODE    Setup or add a new publisher
-    npx skillvault --status         Show all publishers, skills, and statuses
-    npx skillvault --refresh        Re-authenticate expired tokens + sync skills
-    npx skillvault --sync           Sync vaults and install skill stubs
-    npx skillvault                  Start MCP server (default, after setup)
-    npx skillvault --help           Show this help
-    npx skillvault --version        Show version
+    npx skillvault --invite CODE       Setup: redeem invite, sync, install skills
+    npx skillvault --load SKILL        Decrypt and output a skill (used by Claude)
+    npx skillvault --status            Show publishers, skills, and statuses
+    npx skillvault --refresh           Re-authenticate tokens + sync skills
+    npx skillvault --sync              Sync vaults and update skill stubs
+    npx skillvault --help              Show this help
+    npx skillvault --version           Show version
 
-  Skills are encrypted at rest. When Claude Code triggers a skill, the
-  MCP server decrypts it on demand and returns the content to Claude's
-  session. The decrypted content is never written to disk.
+  Skills are encrypted at rest in ~/.skillvault/vaults/. When Claude Code
+  triggers a skill, it runs \`npx skillvault --load <name>\` to decrypt on
+  demand. The decrypted content goes to stdout — never written to disk.
+  License is validated on every load.
 
   Environment:
     SKILLVAULT_API_URL     Server URL (default: https://api.getskillvault.com)
-    SKILLVAULT_MCP_PORT    MCP server port (default: 9877)
   `);
     process.exit(0);
 }
@@ -96,10 +95,10 @@ function saveConfig(config) {
     mkdirSync(CONFIG_DIR, { recursive: true });
     writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), { mode: 0o600 });
 }
-// ── Setup: Redeem Invite + Configure MCP + Sync ──
+// ── Setup: Redeem Invite + Sync + Install ──
 async function setup(code) {
-    console.log('🔐 SkillVault Setup');
-    console.log(`   Redeeming invite code: ${code}`);
+    console.error('🔐 SkillVault Setup');
+    console.error(`   Redeeming invite code: ${code}`);
     const response = await fetch(`${API_URL}/auth/companion/token`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
@@ -111,11 +110,11 @@ async function setup(code) {
         process.exit(1);
     }
     const data = await response.json();
-    console.log(`   ✅ Authenticated`);
+    console.error(`   ✅ Authenticated`);
     if (data.email)
-        console.log(`   📧 ${data.email}`);
+        console.error(`   📧 ${data.email}`);
     if (data.capabilities.length > 0) {
-        console.log(`   📦 Skills: ${data.capabilities.join(', ')}`);
+        console.error(`   📦 Skills: ${data.capabilities.join(', ')}`);
     }
     const existingConfig = loadConfig();
     const publisherEntry = {
@@ -128,11 +127,11 @@ async function setup(code) {
         const existingIdx = existingConfig.publishers.findIndex(p => p.id === data.publisher_id);
         if (existingIdx >= 0) {
             existingConfig.publishers[existingIdx] = publisherEntry;
-            console.log(`   🔄 Updated publisher: ${publisherEntry.name}`);
+            console.error(`   🔄 Updated publisher: ${publisherEntry.name}`);
         }
         else {
             existingConfig.publishers.push(publisherEntry);
-            console.log(`   ➕ Added publisher: ${publisherEntry.name}. You now have skills from ${existingConfig.publishers.length} publishers.`);
+            console.error(`   ➕ Added publisher: ${publisherEntry.name}`);
         }
         if (data.customer_token)
             existingConfig.customer_token = data.customer_token;
@@ -150,49 +149,39 @@ async function setup(code) {
         });
     }
     mkdirSync(join(VAULT_DIR, data.publisher_id), { recursive: true });
-    // Configure MCP server in Claude Code
-    configureMCP();
+    // Clean up legacy MCP config if present
+    cleanupMCPConfig();
     // Sync vaults and install stubs
-    console.log('');
-    console.log('   Syncing skills...');
+    console.error('');
+    console.error('   Syncing skills...');
     await syncSkills();
     const installResult = await installSkillStubs();
-    console.log('');
+    console.error('');
     if (installResult.installed > 0) {
-        console.log(`   ✅ ${installResult.installed} skill${installResult.installed !== 1 ? 's' : ''} ready`);
+        console.error(`   ✅ ${installResult.installed} skill${installResult.installed !== 1 ? 's' : ''} installed to ~/.claude/skills/`);
     }
-    console.log('   Setup complete! Start the agent with: npx skillvault');
-    console.log('   Then restart Claude Code to discover your skills.');
-    console.log('');
+    console.error('   ✅ Setup complete! Restart Claude Code to use your skills.');
+    console.error('');
 }
-/**
- * Configure Claude Code to connect to the SkillVault MCP server.
- */
-function configureMCP() {
+/** Remove legacy MCP server config from ~/.claude/.mcp.json */
+function cleanupMCPConfig() {
     const mcpConfigPath = join(HOME, '.claude', '.mcp.json');
     try {
-        let mcpConfig = {};
         if (existsSync(mcpConfigPath)) {
-            mcpConfig = JSON.parse(readFileSync(mcpConfigPath, 'utf8'));
+            const mcpConfig = JSON.parse(readFileSync(mcpConfigPath, 'utf8'));
+            if (mcpConfig.mcpServers?.skillvault) {
+                delete mcpConfig.mcpServers.skillvault;
+                writeFileSync(mcpConfigPath, JSON.stringify(mcpConfig, null, 2), { mode: 0o600 });
+                console.error('   🧹 Removed legacy MCP config');
+            }
         }
-        if (!mcpConfig.mcpServers)
-            mcpConfig.mcpServers = {};
-        mcpConfig.mcpServers.skillvault = {
-            type: 'url',
-            url: `http://127.0.0.1:${MCP_PORT}/mcp`,
-        };
-        mkdirSync(join(HOME, '.claude'), { recursive: true });
-        writeFileSync(mcpConfigPath, JSON.stringify(mcpConfig, null, 2), { mode: 0o600 });
-        console.log(`   ✅ Claude Code MCP configured`);
-    }
-    catch {
-        console.error(`   ⚠️  Failed to configure MCP — manually add to ~/.claude/.mcp.json`);
     }
+    catch { }
 }
 async function showStatus() {
     const config = loadConfig();
     if (!config) {
-        console.log('🔐 SkillVault Agent\n');
+        console.log('🔐 SkillVault\n');
         console.log('   Not set up yet. Run:');
         console.log('   npx skillvault --invite YOUR_CODE\n');
         process.exit(1);
@@ -201,7 +190,7 @@ async function showStatus() {
     if (config.customer_email)
         console.log(`   Account: ${config.customer_email}`);
     console.log(`   Config:  ${CONFIG_PATH}`);
-    console.log(`   Skills:  ${SKILLS_DIR} (stubs — encrypted at rest)`);
+    console.log(`   Skills:  ${SKILLS_DIR}`);
     console.log(`   Server:  ${config.api_url}`);
     console.log('');
     let skills = [];
@@ -267,15 +256,13 @@ async function showStatus() {
 async function refreshTokens() {
     const config = loadConfig();
     if (!config) {
-        console.log('🔐 SkillVault Agent\n');
-        console.log('   Not set up yet. Run:');
-        console.log('   npx skillvault --invite YOUR_CODE\n');
+        console.error('🔐 SkillVault\n   Not set up. Run: npx skillvault --invite YOUR_CODE\n');
         process.exit(1);
     }
-    console.log('🔐 SkillVault Token Refresh\n');
+    console.error('🔐 SkillVault Token Refresh\n');
     let anyRefreshed = false;
     for (const pub of config.publishers) {
-        process.stdout.write(`   Refreshing ${pub.name}... `);
+        process.stderr.write(`   Refreshing ${pub.name}... `);
         try {
             const res = await fetch(`${config.api_url}/auth/companion/refresh`, {
                 method: 'POST',
@@ -287,26 +274,26 @@ async function refreshTokens() {
                 pub.token = data.token;
                 if (data.customer_token)
                     config.customer_token = data.customer_token;
-                console.log('✅ refreshed');
+                console.error('✅');
                 anyRefreshed = true;
             }
             else if (res.status === 401) {
-                console.log('❌ expired — re-invite required');
+                console.error('❌ expired — re-invite required');
             }
             else {
-                console.log(`❌ server error (${res.status})`);
+                console.error(`❌ server error (${res.status})`);
             }
         }
         catch {
-            console.log('❌ offline');
+            console.error('❌ offline');
         }
     }
     if (anyRefreshed) {
         saveConfig(config);
-        console.log('\n   Tokens updated.\n');
+        console.error('\n   Tokens updated.\n');
     }
     else {
-        console.log('\n   No tokens refreshed. You may need to run: npx skillvault --invite CODE\n');
+        console.error('\n   No tokens refreshed.\n');
     }
 }
 async function syncSkills() {
@@ -337,19 +324,19 @@ async function syncSkills() {
             continue;
         }
         const remoteSkillNames = new Set(skills.map(s => s.skill_name));
-        // Revocation: remove stubs for skills no longer in the remote list
+        // Revocation: remove stubs for skills no longer in remote list
         try {
             if (existsSync(pubVaultDir)) {
                 const localVaults = readdirSync(pubVaultDir).filter(f => f.endsWith('.vault'));
                 for (const vaultFile of localVaults) {
                     const localSkillName = vaultFile.replace(/\.vault$/, '');
                     if (!remoteSkillNames.has(localSkillName)) {
-                        console.log(`[sync] Grant revoked: "${localSkillName}" from ${pub.name}`);
+                        console.error(`[sync] Grant revoked: "${localSkillName}" from ${pub.name}`);
                         const skillDir = join(SKILLS_DIR, localSkillName);
                         try {
                             if (existsSync(skillDir) && existsSync(join(skillDir, 'manifest.json'))) {
                                 rmSync(skillDir, { recursive: true, force: true });
-                                console.log(`[sync] Removed stub: ~/.claude/skills/${localSkillName}/`);
+                                console.error(`[sync] Removed: ~/.claude/skills/${localSkillName}/`);
                             }
                         }
                         catch { }
@@ -358,7 +345,7 @@ async function syncSkills() {
             }
         }
         catch { }
-        // Download missing or updated vaults + write skill metadata for stubs
+        // Download missing or updated vaults
         let pubSynced = 0;
         for (const skill of skills) {
             const vaultPath = join(pubVaultDir, `${skill.skill_name}.vault`);
@@ -371,7 +358,6 @@ async function syncSkills() {
                         const localHash = readFileSync(hashPath, 'utf8').trim();
                         if (localHash !== skill.vault_hash) {
                             needsDownload = true;
-                            console.log(`[sync] Update available: "${skill.skill_name}" from ${pub.name}`);
                         }
                     }
                 }
@@ -394,7 +380,6 @@ async function syncSkills() {
                 writeFileSync(vaultPath, vaultBuffer, { mode: 0o600 });
                 if (dlData.vault_hash)
                     writeFileSync(vaultPath + '.hash', dlData.vault_hash, { mode: 0o600 });
-                // Store skill metadata for stub generation
                 writeFileSync(vaultPath + '.meta', JSON.stringify({
                     skill_name: skill.skill_name,
                     description: skill.description || '',
@@ -404,23 +389,18 @@ async function syncSkills() {
                     publisher_id: pub.id,
                 }), { mode: 0o600 });
                 pubSynced++;
-                console.log(`[sync] ${vaultExists ? 'Updated' : 'Downloaded'}: "${skill.skill_name}" from ${pub.name}`);
+                console.error(`[sync] ${vaultExists ? 'Updated' : 'Downloaded'}: "${skill.skill_name}" from ${pub.name}`);
             }
             catch (err) {
                 errors.push(`${pub.name}/${skill.skill_name}: ${err instanceof Error ? err.message : 'download error'}`);
             }
         }
         if (pubSynced > 0)
-            console.log(`[sync] Synced ${pubSynced} vault${pubSynced !== 1 ? 's' : ''} from ${pub.name}`);
+            console.error(`[sync] Synced ${pubSynced} vault${pubSynced !== 1 ? 's' : ''} from ${pub.name}`);
         totalSynced += pubSynced;
     }
     return { synced: totalSynced, errors };
 }
-/**
- * Install lightweight stub SKILL.md files in ~/.claude/skills/ for each vault.
- * These stubs tell Claude to call the skillvault_load MCP tool to decrypt on demand.
- * No decrypted content is written to disk.
- */
 async function installSkillStubs() {
     const config = loadConfig();
     if (!config || config.publishers.length === 0) {
@@ -441,7 +421,6 @@ async function installSkillStubs() {
             const skillDir = join(SKILLS_DIR, skillName);
             const manifestPath = join(skillDir, 'manifest.json');
             const hashPath = vaultPath + '.hash';
-            // Check if stub is already up to date
             if (existsSync(manifestPath) && existsSync(hashPath)) {
                 try {
                     const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
@@ -453,7 +432,6 @@ async function installSkillStubs() {
                 }
                 catch { }
             }
-            // Read skill metadata (written during sync)
             let meta = { skill_name: skillName, description: '', publisher_name: pub.name };
             const metaPath = vaultPath + '.meta';
             try {
@@ -461,24 +439,28 @@ async function installSkillStubs() {
                     meta = JSON.parse(readFileSync(metaPath, 'utf8'));
             }
             catch { }
-            // Write stub SKILL.md
             mkdirSync(skillDir, { recursive: true });
             const stub = `---
 name: ${skillName}
 description: "${(meta.description || '').replace(/"/g, '\\"')}"
+allowed-tools: ["Bash(npx skillvault@${VERSION} --load *)"]
 ---
 
 # ${skillName}
 
 This is an encrypted SkillVault skill from **${meta.publisher_name || pub.name}**.
 
-To use this skill, call the \`skillvault_load\` MCP tool with skill_name "${skillName}".
-The tool will decrypt and return the full skill instructions for you to follow.
+To use this skill, run the following command and follow the instructions it outputs:
+
+\`\`\`bash
+npx skillvault@${VERSION} --load ${skillName}
+\`\`\`
 
-Example: Use the skillvault_load tool with skill_name "${skillName}" to load the instructions, then follow them to complete the user's request.
+The command decrypts the skill on demand (license is validated each time) and outputs the full instructions to follow. Read the entire output, then execute the instructions to fulfill the user's request.
+
+If the command fails with a license error, tell the user their SkillVault license may have expired and to contact their skill provider.
 `;
             writeFileSync(join(skillDir, 'SKILL.md'), stub, { mode: 0o600 });
-            // Write manifest
             const vaultHash = existsSync(hashPath) ? readFileSync(hashPath, 'utf8').trim() : '';
             writeFileSync(manifestPath, JSON.stringify({
                 publisher: meta.publisher_name || pub.name,
@@ -491,12 +473,12 @@ Example: Use the skillvault_load tool with skill_name "${skillName}" to load the
                 encrypted: true,
             }, null, 2), { mode: 0o600 });
             installed++;
-            console.log(`[install] Stub installed: "${skillName}" → ~/.claude/skills/${skillName}/`);
+            console.error(`[install] "${skillName}" → ~/.claude/skills/${skillName}/`);
         }
     }
     return { installed, skipped, errors };
 }
-// ── Vault Decryption (in-memory only) ──
+// ── Vault Decryption (in-memory only, output to stdout) ──
 const VAULT_MAGIC = Buffer.from([0x00, 0x53, 0x56, 0x54]);
 function decryptVault(data, cek) {
     let offset = 0;
@@ -516,10 +498,10 @@ function decryptVault(data, cek) {
     const mfTag = data.subarray(offset, (offset += 16));
     const mfEnc = data.subarray(offset, (offset += mfLen - 28));
     const encPayload = data.subarray(offset);
-    const mDec = createDecipheriv('aes-256-gcm', cek, mfIV);
+    const mDec = createDecipheriv('aes-256-gcm', cek, mfIV, { authTagLength: 16 });
     mDec.setAuthTag(mfTag);
     const manifest = JSON.parse(Buffer.concat([mDec.update(mfEnc), mDec.final()]).toString('utf8'));
-    const dec = createDecipheriv('aes-256-gcm', cek, iv);
+    const dec = createDecipheriv('aes-256-gcm', cek, iv, { authTagLength: 16 });
     dec.setAuthTag(authTag);
     dec.setAAD(metadataJSON);
     const payload = Buffer.concat([dec.update(encPayload), dec.final()]);
@@ -557,13 +539,12 @@ async function fetchCEK(skillName, publisherToken) {
     const shared = diffieHellman({ publicKey: ephPub, privateKey: kp.privateKey });
     const wrapKey = Buffer.from(hkdfSync('sha256', shared, Buffer.alloc(32, 0), Buffer.from('skillvault-cek-wrap-v1'), 32));
     shared.fill(0);
-    const d = createDecipheriv('aes-256-gcm', wrapKey, Buffer.from(wc.iv, 'base64'));
+    const d = createDecipheriv('aes-256-gcm', wrapKey, Buffer.from(wc.iv, 'base64'), { authTagLength: 16 });
     d.setAuthTag(Buffer.from(wc.authTag, 'base64'));
     const cek = Buffer.concat([d.update(Buffer.from(wc.wrappedKey, 'base64')), d.final()]);
     wrapKey.fill(0);
     return cek;
 }
-// ── Watermark ──
 function watermark(content, id) {
     const hex = Buffer.from(id, 'utf8').toString('hex');
     if (!hex)
@@ -572,21 +553,27 @@ function watermark(content, id) {
     const mark = BigInt('0x' + hex).toString(4).split('').map(d => zw[d]).join('');
     return content.split('\n').map((l, i) => (i > 0 && i % 5 === 0 ? l + mark : l)).join('\n');
 }
-// ── On-Demand Skill Loading (MCP tool handler) ──
 function validateSkillName(name) {
     return /^[a-zA-Z0-9_-]+$/.test(name) && name.length > 0 && name.length <= 128;
 }
+/**
+ * Load (decrypt) a skill and output to stdout.
+ * Status messages go to stderr so they don't pollute the skill content.
+ */
 async function loadSkill(skillName) {
     if (!validateSkillName(skillName)) {
-        return { success: false, content: '', error: 'Invalid skill name. Only letters, numbers, hyphens, and underscores allowed.' };
+        console.error('Error: Invalid skill name.');
+        process.exit(1);
     }
     const config = loadConfig();
     if (!config) {
-        return { success: false, content: '', error: 'Not configured. Run: npx skillvault --invite CODE' };
+        console.error('Error: Not configured. Run: npx skillvault --invite YOUR_CODE');
+        process.exit(1);
     }
     const resolved = resolveSkillPublisher(skillName, config);
     if (!resolved) {
-        return { success: false, content: '', error: `Vault not found for "${skillName}". Run: npx skillvault --sync` };
+        console.error(`Error: Vault not found for "${skillName}". Run: npx skillvault --sync`);
+        process.exit(1);
     }
     const licenseeId = config.customer_email || 'unknown';
     // Fetch CEK — validates license on every load
@@ -595,155 +582,38 @@ async function loadSkill(skillName) {
         cek = await fetchCEK(skillName, resolved.publisher.token);
     }
     catch (err) {
-        return { success: false, content: '', error: `License check failed: ${err instanceof Error ? err.message : 'unknown'}. Your license may have been revoked.` };
+        console.error(`Error: License check failed — ${err instanceof Error ? err.message : 'unknown'}`);
+        console.error('Your license may have expired or been revoked. Contact your skill provider.');
+        process.exit(1);
     }
-    // Decrypt in memory — content never touches disk
+    // Decrypt in memory
     try {
         const vaultData = readFileSync(resolved.vaultPath);
         const vault = decryptVault(vaultData, cek);
         cek.fill(0);
-        // Combine all files into a single response, with SKILL.md first
+        // Output SKILL.md first, then other files — all to stdout
         const skillMd = vault.files.find(f => f.path === 'SKILL.md');
         const otherFiles = vault.files.filter(f => f.path !== 'SKILL.md');
-        let content = '';
         if (skillMd) {
-            content = watermark(skillMd.content, licenseeId);
+            process.stdout.write(watermark(skillMd.content, licenseeId));
         }
         for (const file of otherFiles) {
-            content += `\n\n---\n# File: ${file.path}\n\n${watermark(file.content, licenseeId)}`;
+            process.stdout.write(`\n\n---\n# File: ${file.path}\n\n${watermark(file.content, licenseeId)}`);
         }
-        return { success: true, content };
     }
     catch (err) {
         cek.fill(0);
-        return { success: false, content: '', error: `Decryption failed: ${err instanceof Error ? err.message : 'unknown'}` };
-    }
-}
-function rpcOk(id, result) { return JSON.stringify({ jsonrpc: '2.0', id, result }); }
-function rpcErr(id, code, msg) { return JSON.stringify({ jsonrpc: '2.0', id, error: { code, message: msg } }); }
-async function handleRPC(req) {
-    switch (req.method) {
-        case 'initialize':
-            return rpcOk(req.id, { protocolVersion: '2024-11-05', capabilities: { tools: {} }, serverInfo: { name: 'skillvault', version: VERSION } });
-        case 'tools/list':
-            return rpcOk(req.id, {
-                tools: [{
-                        name: 'skillvault_load',
-                        description: 'Load and decrypt a SkillVault skill. Returns the full skill instructions for you to follow. The skill is decrypted on demand — license is validated each time. Call this when a stub SKILL.md tells you to load a skill.',
-                        inputSchema: {
-                            type: 'object',
-                            properties: {
-                                skill_name: { type: 'string', description: 'Name of the skill to load (from the stub SKILL.md)' },
-                            },
-                            required: ['skill_name'],
-                        },
-                    }],
-            });
-        case 'tools/call': {
-            const name = req.params?.name;
-            const { skill_name } = req.params?.arguments || {};
-            if (name !== 'skillvault_load')
-                return rpcErr(req.id, -32601, `Unknown tool: ${name}`);
-            if (!skill_name)
-                return rpcErr(req.id, -32602, 'skill_name required');
-            console.log(`[MCP] Loading: ${skill_name}`);
-            const result = await loadSkill(skill_name);
-            return rpcOk(req.id, {
-                content: [{ type: 'text', text: result.success ? result.content : `Error: ${result.error}` }],
-                isError: !result.success,
-            });
-        }
-        case 'notifications/initialized': return '';
-        default: return rpcErr(req.id || 0, -32601, `Unknown method: ${req.method}`);
+        console.error(`Error: Decryption failed — ${err instanceof Error ? err.message : 'unknown'}`);
+        process.exit(1);
     }
 }
-function startServer() {
-    const server = createServer(async (req, res) => {
-        if (req.method === 'OPTIONS') {
-            res.writeHead(403);
-            res.end();
-            return;
-        }
-        if (req.method !== 'POST' || req.url !== '/mcp') {
-            res.writeHead(404);
-            res.end(JSON.stringify({ error: 'POST /mcp' }));
-            return;
-        }
-        const chunks = [];
-        let size = 0;
-        const MAX_BODY = 1024 * 1024;
-        req.on('data', (c) => { size += c.length; if (size > MAX_BODY) {
-            req.destroy();
-            return;
-        } chunks.push(c); });
-        req.on('end', async () => {
-            if (size > MAX_BODY) {
-                res.writeHead(413);
-                res.end('Request too large');
-                return;
-            }
-            try {
-                const rpc = JSON.parse(Buffer.concat(chunks).toString('utf8'));
-                const result = await handleRPC(rpc);
-                if (result) {
-                    res.writeHead(200, { 'Content-Type': 'application/json' });
-                    res.end(result);
-                }
-                else {
-                    res.writeHead(204);
-                    res.end();
-                }
-            }
-            catch {
-                res.writeHead(400);
-                res.end(JSON.stringify({ jsonrpc: '2.0', id: null, error: { code: -32700, message: 'Parse error' } }));
-            }
-        });
-    });
-    server.listen(MCP_PORT, '127.0.0.1', () => {
-        console.log(`🔐 SkillVault MCP server running on 127.0.0.1:${MCP_PORT}`);
-        const config = loadConfig();
-        if (config)
-            console.log(`   Publishers: ${config.publishers.map(p => p.name).join(', ')}`);
-        console.log(`   Skills are encrypted at rest — decrypted on demand per session.`);
-        console.log(`   Press Ctrl+C to stop.\n`);
-        // Background sync
-        syncSkills().then(({ synced, errors }) => {
-            if (synced > 0)
-                console.log(`[sync] Startup: ${synced} vault${synced !== 1 ? 's' : ''} synced`);
-            if (errors.length > 0)
-                console.log(`[sync] Errors: ${errors.join('; ')}`);
-            return installSkillStubs();
-        }).then(({ installed }) => {
-            if (installed > 0)
-                console.log(`[install] ${installed} stub${installed !== 1 ? 's' : ''} updated`);
-        }).catch((err) => {
-            console.error('[sync] Startup sync failed:', err instanceof Error ? err.message : err);
-        });
-        // Periodic sync every 5 minutes
-        setInterval(() => {
-            syncSkills().then(({ synced, errors }) => {
-                if (synced > 0)
-                    console.log(`[sync] ${synced} vault${synced !== 1 ? 's' : ''} synced`);
-                if (errors.length > 0)
-                    console.log(`[sync] Errors: ${errors.join('; ')}`);
-                return installSkillStubs();
-            }).then(({ installed }) => {
-                if (installed > 0)
-                    console.log(`[install] ${installed} stub${installed !== 1 ? 's' : ''} updated`);
-            }).catch(() => { });
-        }, 5 * 60 * 1000);
-    });
-    server.on('error', (err) => {
-        if (err.code === 'EADDRINUSE') {
-            console.log(`   SkillVault is already running on port ${MCP_PORT}`);
-            process.exit(0);
-        }
-        console.error('Server error:', err);
-    });
-}
 // ── Main ──
 async function main() {
+    // --load: decrypt and output a skill (used by Claude Code via Bash)
+    if (loadSkillName) {
+        await loadSkill(loadSkillName);
+        process.exit(0);
+    }
     if (inviteCode) {
         await setup(inviteCode);
         if (!statusFlag && !refreshFlag)
@@ -755,35 +625,37 @@ async function main() {
     }
     if (refreshFlag) {
         await refreshTokens();
+        console.error('   Syncing skills...\n');
         await syncSkills();
         const result = await installSkillStubs();
         if (result.installed > 0)
-            console.log(`   ✅ ${result.installed} stub${result.installed !== 1 ? 's' : ''} updated`);
-        console.log('');
+            console.error(`   ✅ ${result.installed} skill${result.installed !== 1 ? 's' : ''} updated`);
+        console.error('');
         process.exit(0);
     }
     if (syncFlag) {
         const config = loadConfig();
         if (!config) {
-            console.log('🔐 Not set up. Run: npx skillvault --invite YOUR_CODE\n');
+            console.error('🔐 Not set up. Run: npx skillvault --invite YOUR_CODE\n');
             process.exit(1);
         }
-        console.log('🔐 SkillVault Sync\n');
+        console.error('🔐 SkillVault Sync\n');
         await syncSkills();
         const result = await installSkillStubs();
-        console.log(`\n   ✅ ${result.installed} installed, ${result.skipped} up to date`);
-        console.log('');
+        console.error(`\n   ✅ ${result.installed} installed, ${result.skipped} up to date\n`);
         process.exit(0);
     }
-    // Default: start MCP server
+    // Default: show help
+    console.log(`🔐 SkillVault v${VERSION}\n`);
     const config = loadConfig();
-    if (!config) {
-        console.log('🔐 SkillVault\n');
+    if (config) {
+        console.log(`   ${config.publishers.length} publisher${config.publishers.length !== 1 ? 's' : ''} configured`);
+        console.log('   Run --status for details, --sync to update skills\n');
+    }
+    else {
         console.log('   Not set up yet. Run:');
         console.log('   npx skillvault --invite YOUR_CODE\n');
-        process.exit(1);
     }
-    startServer();
 }
 main().catch((err) => {
     console.error('Fatal:', err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillvault",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "SkillVault — secure skill distribution for Claude Code",
   "type": "module",
   "bin": {