skillvault 0.5.2 → 0.7.0

package/dist/cli.js

@@ -20,7 +20,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { createDecipheriv, createPublicKey, diffieHellman, hkdfSync, generateKeyPairSync, } from 'node:crypto';
-const VERSION = '0.5.2';
+const VERSION = '0.7.0';
 const HOME = process.env.HOME || process.env.USERPROFILE || '~';
 const API_URL = process.env.SKILLVAULT_API_URL || 'https://api.getskillvault.com';
 const CONFIG_DIR = join(HOME, '.skillvault');
@@ -235,24 +235,33 @@ async function showStatus() {
     console.log('');
     let skills = [];
     let online = false;
-    try {
-        const token = config.customer_token || (config.publishers.length > 0 ? config.publishers[0].token : null);
-        if (token) {
-            const res = await fetch(`${config.api_url}/customer/skills`, {
-                headers: { 'Authorization': `Bearer ${token}` },
+    // Fetch skills from each publisher using companion tokens
+    for (const pub of config.publishers) {
+        try {
+            const res = await fetch(`${config.api_url}/agent/skills?publisher_id=${encodeURIComponent(pub.id)}`, {
+                headers: { 'Authorization': `Bearer ${pub.token}` },
                 signal: AbortSignal.timeout(5000),
             });
             if (res.ok) {
                 const data = await res.json();
-                skills = data.skills || [];
+                for (const s of (data.skills || [])) {
+                    skills.push({
+                        skill_name: s.skill_name,
+                        publisher_id: pub.id,
+                        publisher_name: pub.name,
+                        status: s.status || 'active',
+                        expires_at: null,
+                        last_used: null,
+                    });
+                }
                 online = true;
             }
             else if (res.status === 401) {
-                console.log('   ⚠️  Session expired. Run: npx skillvault --refresh\n');
+                console.log(`   ⚠️  Token expired for ${pub.name}. Run: npx skillvault --refresh\n`);
             }
         }
+        catch { }
     }
-    catch { }
     console.log('   Publishers:');
     console.log('   ' + '-'.repeat(60));
     console.log(`   ${'Name'.padEnd(25)} ${'Skills'.padEnd(10)} ${'Status'.padEnd(15)}`);
@@ -348,7 +357,7 @@ async function syncSkills() {
         mkdirSync(pubVaultDir, { recursive: true });
         let skills = [];
         try {
-            const res = await fetch(`${config.api_url}/skills?publisher_id=${encodeURIComponent(pub.id)}`, {
+            const res = await fetch(`${config.api_url}/agent/skills?publisher_id=${encodeURIComponent(pub.id)}`, {
                 headers: { 'Authorization': `Bearer ${pub.token}` },
                 signal: AbortSignal.timeout(10000),
             });
@@ -642,8 +651,66 @@ function watermark(content, id) {
 function validateSkillName(name) {
     return /^[a-zA-Z0-9_-]+$/.test(name) && name.length > 0 && name.length <= 128;
 }
+/**
+ * Quick sync for a single skill — checks for vault update before decrypting.
+ * Returns true if the vault was updated. Status goes to stderr.
+ */
+async function syncSingleSkill(skillName, pub, config) {
+    try {
+        const capabilityName = `skill/${skillName.toLowerCase()}`;
+        const res = await fetch(`${config.api_url}/skills/check-update?capability=${encodeURIComponent(capabilityName)}&current_version=0.0.0`, { signal: AbortSignal.timeout(5000) });
+        if (!res.ok)
+            return false;
+        const data = await res.json();
+        // Check if local vault hash matches
+        const vaultPath = join(VAULT_DIR, pub.id, `${skillName}.vault`);
+        const hashPath = vaultPath + '.hash';
+        if (existsSync(hashPath) && data.vault_hash) {
+            const localHash = readFileSync(hashPath, 'utf8').trim();
+            if (localHash === data.vault_hash)
+                return false; // already up to date
+        }
+        // Download updated vault
+        const dlRes = await fetch(`${config.api_url}/skills/download?capability=${encodeURIComponent(capabilityName)}`, { headers: { 'Authorization': `Bearer ${pub.token}` }, signal: AbortSignal.timeout(15000) });
+        if (!dlRes.ok)
+            return false;
+        const dlData = await dlRes.json();
+        const vaultBuffer = Buffer.from(dlData.vault_data, 'base64');
+        mkdirSync(join(VAULT_DIR, pub.id), { recursive: true });
+        writeFileSync(vaultPath, vaultBuffer, { mode: 0o600 });
+        if (dlData.vault_hash)
+            writeFileSync(hashPath, dlData.vault_hash, { mode: 0o600 });
+        writeFileSync(vaultPath + '.meta', JSON.stringify({
+            skill_name: skillName,
+            description: '',
+            capability_name: capabilityName,
+            version: dlData.version || data.latest_version,
+            publisher_name: pub.name,
+            publisher_id: pub.id,
+        }), { mode: 0o600 });
+        console.error(`[sync] Updated "${skillName}" to v${dlData.version || data.latest_version}`);
+        return true;
+    }
+    catch {
+        return false; // sync failure is non-fatal — use existing vault
+    }
+}
+/**
+ * Background sync for all skills across all publishers.
+ * Discovers new skills the customer has been granted since last sync.
+ * Runs async — doesn't block the load operation.
+ */
+async function backgroundSyncAll(config) {
+    try {
+        await syncSkills();
+        await installSkillStubs();
+    }
+    catch { } // non-fatal
+}
 /**
  * Load (decrypt) a skill and output to stdout.
+ * Syncs the requested skill first to ensure latest version.
+ * Triggers background sync for all other skills.
  * Status messages go to stderr so they don't pollute the skill content.
  */
 async function loadSkill(skillName) {
@@ -656,11 +723,27 @@ async function loadSkill(skillName) {
         console.error('Error: Not configured. Run: npx skillvault --invite YOUR_CODE');
         process.exit(1);
     }
-    const resolved = resolveSkillPublisher(skillName, config);
+    // Pre-load sync: ensure we have the latest vault for this skill
+    let resolved = resolveSkillPublisher(skillName, config);
+    if (resolved) {
+        await syncSingleSkill(skillName, resolved.publisher, config);
+        // Re-resolve in case the vault was just downloaded
+        resolved = resolveSkillPublisher(skillName, config);
+    }
+    else {
+        // Skill not found locally — try a full sync first (may be a newly granted skill)
+        console.error(`[sync] Skill "${skillName}" not found locally, syncing...`);
+        await syncSkills();
+        await installSkillStubs();
+        resolved = resolveSkillPublisher(skillName, config);
+    }
     if (!resolved) {
-        console.error(`Error: Vault not found for "${skillName}". Run: npx skillvault --sync`);
+        console.error(`Error: Vault not found for "${skillName}" after sync.`);
+        console.error('You may not have access to this skill. Check with your skill provider.');
         process.exit(1);
     }
+    // Kick off background sync for all other skills (non-blocking)
+    backgroundSyncAll(config).catch(() => { });
     const licenseeId = config.customer_email || 'unknown';
     // Fetch CEK — validates license on every load
     let cek;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillvault",
-  "version": "0.5.2",
+  "version": "0.7.0",
   "description": "SkillVault — secure skill distribution for Claude Code",
   "type": "module",
   "bin": {