skillvault 0.5.0 → 0.5.2

package/dist/cli.js

@@ -20,7 +20,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { createDecipheriv, createPublicKey, diffieHellman, hkdfSync, generateKeyPairSync, } from 'node:crypto';
-const VERSION = '0.5.0';
+const VERSION = '0.5.2';
 const HOME = process.env.HOME || process.env.USERPROFILE || '~';
 const API_URL = process.env.SKILLVAULT_API_URL || 'https://api.getskillvault.com';
 const CONFIG_DIR = join(HOME, '.skillvault');
@@ -151,6 +151,8 @@ async function setup(code) {
     mkdirSync(join(VAULT_DIR, data.publisher_id), { recursive: true });
     // Clean up legacy MCP config if present
     cleanupMCPConfig();
+    // Install session hook for auto-sync
+    configureSessionHook();
     // Sync vaults and install stubs
     console.error('');
     console.error('   Syncing skills...');
@@ -161,6 +163,7 @@ async function setup(code) {
         console.error(`   ✅ ${installResult.installed} skill${installResult.installed !== 1 ? 's' : ''} installed to ~/.claude/skills/`);
     }
     console.error('   ✅ Setup complete! Restart Claude Code to use your skills.');
+    console.error('   Skills will auto-sync at the start of each Claude Code session.');
     console.error('');
 }
 /** Remove legacy MCP server config from ~/.claude/.mcp.json */
@@ -178,6 +181,43 @@ function cleanupMCPConfig() {
     }
     catch { }
 }
+/**
+ * Install a SessionStart hook in Claude Code settings so skills auto-sync
+ * at the start of each session. This discovers new skills from all
+ * existing publishers without the customer doing anything.
+ */
+function configureSessionHook() {
+    const settingsPath = join(HOME, '.claude', 'settings.json');
+    try {
+        let settings = {};
+        if (existsSync(settingsPath)) {
+            settings = JSON.parse(readFileSync(settingsPath, 'utf8'));
+        }
+        if (!settings.hooks)
+            settings.hooks = {};
+        if (!settings.hooks.SessionStart)
+            settings.hooks.SessionStart = [];
+        // Check if we already have a skillvault sync hook
+        const hasHook = settings.hooks.SessionStart.some((group) => group.matcher === 'startup' &&
+            group.hooks?.some((h) => h.command?.includes('skillvault')));
+        if (!hasHook) {
+            settings.hooks.SessionStart.push({
+                matcher: 'startup',
+                hooks: [{
+                        type: 'command',
+                        command: `npx skillvault@${VERSION} --sync`,
+                        timeout: 30,
+                    }],
+            });
+            mkdirSync(join(HOME, '.claude'), { recursive: true });
+            writeFileSync(settingsPath, JSON.stringify(settings, null, 2), { mode: 0o600 });
+            console.error('   ✅ Auto-sync hook installed');
+        }
+    }
+    catch {
+        console.error('   ⚠️  Could not install auto-sync hook — run npx skillvault --sync manually');
+    }
+}
 async function showStatus() {
     const config = loadConfig();
     if (!config) {
@@ -439,14 +479,60 @@ async function installSkillStubs() {
                     meta = JSON.parse(readFileSync(metaPath, 'utf8'));
             }
             catch { }
+            // Decrypt vault to extract frontmatter (name, description, triggers)
+            // The frontmatter is the "public storefront" — body stays encrypted
+            let frontmatter = '';
+            let frontmatterFields = {};
+            try {
+                const cek = await fetchCEK(skillName, pub.token);
+                const vaultData = readFileSync(vaultPath);
+                const vault = decryptVault(vaultData, cek);
+                cek.fill(0);
+                const skillMd = vault.files.find(f => f.path === 'SKILL.md');
+                if (skillMd) {
+                    const fmMatch = skillMd.content.match(/^---\n([\s\S]*?)\n---/);
+                    if (fmMatch) {
+                        frontmatter = fmMatch[1];
+                        // Parse YAML-like frontmatter fields
+                        for (const line of frontmatter.split('\n')) {
+                            const kv = line.match(/^(\S+):\s*(.+)$/);
+                            if (kv)
+                                frontmatterFields[kv[1]] = kv[2].replace(/^["']|["']$/g, '');
+                        }
+                    }
+                }
+            }
+            catch {
+                // If decrypt fails during stub install (e.g. offline), fall back to meta
+            }
+            const stubName = frontmatterFields['name'] || skillName;
+            const stubDescription = frontmatterFields['description'] || meta.description || '';
+            // Build frontmatter for stub — copy all fields except body-related ones
+            let stubFrontmatter = `name: ${stubName}\n`;
+            stubFrontmatter += `description: "${stubDescription.replace(/"/g, '\\"')}"\n`;
+            // Preserve publisher's allowed-tools, trigger config, etc. but always include our load tool
+            const publisherAllowedTools = frontmatterFields['allowed-tools'] || '';
+            const loadTool = `"Bash(npx skillvault@${VERSION} --load *)"`;
+            if (publisherAllowedTools && !publisherAllowedTools.includes('skillvault')) {
+                // Merge publisher's allowed-tools with ours
+                const merged = publisherAllowedTools.replace(/\]$/, `, ${loadTool}]`);
+                stubFrontmatter += `allowed-tools: ${merged}\n`;
+            }
+            else {
+                stubFrontmatter += `allowed-tools: [${loadTool}]\n`;
+            }
+            // Copy through other frontmatter fields the publisher set (for Claude triggering)
+            for (const [key, value] of Object.entries(frontmatterFields)) {
+                if (!['name', 'description', 'allowed-tools'].includes(key)) {
+                    stubFrontmatter += `${key}: ${value}\n`;
+                }
+            }
             mkdirSync(skillDir, { recursive: true });
             const stub = `---
-name: ${skillName}
-description: "${(meta.description || '').replace(/"/g, '\\"')}"
-allowed-tools: ["Bash(npx skillvault@${VERSION} --load *)"]
+${stubFrontmatter.trimEnd()}
 ---
 
-# ${skillName}
+# ${stubName}
 
 This is an encrypted SkillVault skill from **${meta.publisher_name || pub.name}**.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillvault",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "SkillVault — secure skill distribution for Claude Code",
   "type": "module",
   "bin": {