skillvault 0.7.3 → 0.7.5

package/dist/cli.js

@@ -20,7 +20,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { createDecipheriv, createHmac, createPublicKey, diffieHellman, hkdfSync, generateKeyPairSync, } from 'node:crypto';
-const VERSION = '0.7.3';
+const VERSION = '0.7.5';
 const HOME = process.env.HOME || process.env.USERPROFILE || '~';
 const API_URL = process.env.SKILLVAULT_API_URL || 'https://api.getskillvault.com';
 const CONFIG_DIR = join(HOME, '.skillvault');
@@ -108,16 +108,17 @@ async function setup(code) {
         const err = await response.json().catch(() => ({ message: response.statusText }));
         console.error(`   ❌ Failed: ${err.message}`);
         console.error('');
-        if (err.message.includes('404') || err.message.includes('not found')) {
+        if (response.status === 404 || err.message.toLowerCase().includes('not found') || err.message.toLowerCase().includes('invalid')) {
             console.error('   The invite code was not found. Check that you entered it correctly.');
-            console.error('   Invite codes are 8 characters (e.g. A1B2C3D4).');
+            console.error('   Invite codes are 8 characters, letters and numbers (e.g. A1B2C3D4).');
+            console.error('   Ask the skill publisher if you need a new code.');
         }
-        else if (err.message.includes('400') || err.message.includes('expired')) {
+        else if (response.status === 400 || err.message.toLowerCase().includes('expired') || err.message.toLowerCase().includes('redeemed')) {
             console.error('   This invite code has already been used or has expired.');
             console.error('   Ask the publisher for a new invite code.');
         }
         else {
-            console.error('   Could not reach the SkillVault server. Check your internet connection.');
+            console.error('   Could not reach the SkillVault server or an unexpected error occurred.');
             console.error(`   Server: ${API_URL}`);
         }
         process.exit(1);
@@ -506,7 +507,7 @@ async function installSkillStubs() {
             let frontmatter = '';
             let frontmatterFields = {};
             try {
-                const { cek } = await fetchCEK(skillName, pub.token);
+                const { cek } = await fetchCEK(skillName, pub.token, config.api_url || API_URL);
                 const vaultData = readFileSync(vaultPath);
                 const vault = decryptVault(vaultData, cek);
                 cek.fill(0);
@@ -532,17 +533,9 @@ async function installSkillStubs() {
             // Build frontmatter for stub — copy all fields except body-related ones
             let stubFrontmatter = `name: ${stubName}\n`;
             stubFrontmatter += `description: "${stubDescription.replace(/"/g, '\\"')}"\n`;
-            // Preserve publisher's allowed-tools, trigger config, etc. but always include our load tool
-            const publisherAllowedTools = frontmatterFields['allowed-tools'] || '';
-            const loadTool = `"Bash(npx skillvault@${VERSION} --load *)"`;
-            if (publisherAllowedTools && !publisherAllowedTools.includes('skillvault')) {
-                // Merge publisher's allowed-tools with ours
-                const merged = publisherAllowedTools.replace(/\]$/, `, ${loadTool}]`);
-                stubFrontmatter += `allowed-tools: ${merged}\n`;
-            }
-            else {
-                stubFrontmatter += `allowed-tools: [${loadTool}]\n`;
-            }
+            // Only allow our specific load tool — do NOT merge publisher-specified allowed-tools
+            const loadTool = `"Bash(npx skillvault@${VERSION} --load ${skillName})"`;
+            stubFrontmatter += `allowed-tools: [${loadTool}]\n`;
             // Copy through other frontmatter fields the publisher set (for Claude triggering)
             for (const [key, value] of Object.entries(frontmatterFields)) {
                 if (!['name', 'description', 'allowed-tools'].includes(key)) {
@@ -632,10 +625,10 @@ function resolveSkillPublisher(skillName, config) {
     }
     return null;
 }
-async function fetchCEK(skillName, publisherToken) {
+async function fetchCEK(skillName, publisherToken, apiUrl) {
     const kp = generateKeyPairSync('x25519');
     const pub = kp.publicKey.export({ type: 'spki', format: 'der' }).toString('base64');
-    const res = await fetch(`${API_URL}/v1/skills/${skillName}/cek`, {
+    const res = await fetch(`${apiUrl}/v1/skills/${skillName}/cek`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${publisherToken}` },
         body: JSON.stringify({ companion_public_key: pub }),
@@ -688,8 +681,8 @@ function watermarkLayer2(content, id) {
 }
 /** Layer 3: Structural fingerprint — HMAC comment tag in code blocks */
 function watermarkLayer3(content, id) {
-    const hmac = createHmac('sha256', 'skillvault-structural-v1');
-    hmac.update(id);
+    const hmac = createHmac('sha256', id);
+    hmac.update('skillvault-structural-v1');
     const tag = `// sv:${hmac.digest('hex').slice(0, 12)}`;
     const lines = content.split('\n');
     const result = [];
@@ -903,7 +896,7 @@ async function loadSkill(skillName) {
     let cek;
     let licenseeId;
     try {
-        const cekResult = await fetchCEK(skillName, resolved.publisher.token);
+        const cekResult = await fetchCEK(skillName, resolved.publisher.token, config.api_url || API_URL);
         cek = cekResult.cek;
         // Use server-provided watermark ID (includes grant ID, customer ID, timestamp)
         // Falls back to local composite if server didn't provide one
@@ -1015,15 +1008,21 @@ async function main() {
         process.exit(0);
     }
     // Default: show help
-    console.log(`🔐 SkillVault v${VERSION}\n`);
+    console.log(`🔐 SkillVault v${VERSION} — Encrypted skill distribution for Claude Code\n`);
     const config = loadConfig();
     if (config) {
         console.log(`   ${config.publishers.length} publisher${config.publishers.length !== 1 ? 's' : ''} configured`);
         console.log('   Run --status for details, --sync to update skills\n');
     }
     else {
-        console.log('   Not set up yet. Run:');
+        console.log('   SkillVault delivers encrypted AI skills to your Claude Code agent.');
+        console.log('   Skills are published by providers and installed via invite codes.\n');
+        console.log('   To get started, you need an invite code from a skill publisher.');
+        console.log('   Once you have one, run:\n');
         console.log('   npx skillvault --invite YOUR_CODE\n');
+        console.log('   This will download your skills and install them into Claude Code.');
+        console.log('   After setup, restart Claude Code and your skills will be available.\n');
+        console.log('   Learn more: https://app.getskillvault.com\n');
     }
 }
 main().catch((err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillvault",
-  "version": "0.7.3",
+  "version": "0.7.5",
   "description": "SkillVault — secure skill distribution for Claude Code",
   "type": "module",
   "bin": {