skillvault 0.7.5 → 0.8.1

package/dist/cli.js

@@ -20,12 +20,31 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { createDecipheriv, createHmac, createPublicKey, diffieHellman, hkdfSync, generateKeyPairSync, } from 'node:crypto';
-const VERSION = '0.7.5';
+const VERSION = '0.8.1';
 const HOME = process.env.HOME || process.env.USERPROFILE || '~';
 const API_URL = process.env.SKILLVAULT_API_URL || 'https://api.getskillvault.com';
 const CONFIG_DIR = join(HOME, '.skillvault');
 const CONFIG_PATH = join(CONFIG_DIR, 'agent-config.json');
 const VAULT_DIR = join(CONFIG_DIR, 'vaults');
+const AGENTS_SKILLS_DIR = join(HOME, '.agents', 'skills'); // agent-agnostic source of truth
+const AGENTS_LOCK_PATH = join(HOME, '.agents', '.skill-lock.json');
+/** Detect which AI agent platforms are installed and return their skill directories */
+function detectAgentPlatforms() {
+    const platforms = [];
+    const checks = [
+        { name: 'Claude Code', dir: join(HOME, '.claude', 'skills'), marker: join(HOME, '.claude') },
+        { name: 'Cursor', dir: join(HOME, '.cursor', 'skills'), marker: join(HOME, '.cursor') },
+        { name: 'Windsurf', dir: join(HOME, '.windsurf', 'skills'), marker: join(HOME, '.windsurf') },
+        { name: 'Codex', dir: join(HOME, '.codex', 'skills'), marker: join(HOME, '.codex') },
+    ];
+    for (const check of checks) {
+        if (existsSync(check.marker)) {
+            platforms.push({ name: check.name, dir: check.dir });
+        }
+    }
+    return platforms;
+}
+// Legacy: SKILLS_DIR points to Claude for backward compat in other functions
 const SKILLS_DIR = join(HOME, '.claude', 'skills');
 // ── CLI Argument Parsing ──
 const args = process.argv.slice(2);
@@ -395,14 +414,23 @@ async function syncSkills() {
                     const localSkillName = vaultFile.replace(/\.vault$/, '');
                     if (!remoteSkillNames.has(localSkillName)) {
                         console.error(`[sync] Grant revoked: "${localSkillName}" from ${pub.name}`);
-                        const skillDir = join(SKILLS_DIR, localSkillName);
+                        // Remove from agent-agnostic dir
+                        const agentDir = join(AGENTS_SKILLS_DIR, localSkillName);
                         try {
-                            if (existsSync(skillDir) && existsSync(join(skillDir, 'manifest.json'))) {
-                                rmSync(skillDir, { recursive: true, force: true });
-                                console.error(`[sync] Removed: ~/.claude/skills/${localSkillName}/`);
-                            }
+                            if (existsSync(agentDir))
+                                rmSync(agentDir, { recursive: true, force: true });
                         }
                         catch { }
+                        // Remove from all detected agent platforms
+                        for (const platform of detectAgentPlatforms()) {
+                            const platformDir = join(platform.dir, localSkillName);
+                            try {
+                                if (existsSync(platformDir))
+                                    rmSync(platformDir, { recursive: true, force: true });
+                            }
+                            catch { }
+                        }
+                        console.error(`[sync] Removed "${localSkillName}" from all agent platforms`);
                     }
                 }
             }
@@ -472,7 +500,19 @@ async function installSkillStubs() {
     let installed = 0;
     let skipped = 0;
     const errors = [];
-    mkdirSync(SKILLS_DIR, { recursive: true });
+    mkdirSync(AGENTS_SKILLS_DIR, { recursive: true });
+    const detectedPlatforms = detectAgentPlatforms();
+    for (const platform of detectedPlatforms) {
+        mkdirSync(platform.dir, { recursive: true });
+    }
+    // Load existing lock file
+    let lockData = { version: 3, skills: {} };
+    try {
+        if (existsSync(AGENTS_LOCK_PATH)) {
+            lockData = JSON.parse(readFileSync(AGENTS_LOCK_PATH, 'utf8'));
+        }
+    }
+    catch { }
     for (const pub of config.publishers) {
         const pubVaultDir = join(VAULT_DIR, pub.id);
         if (!existsSync(pubVaultDir))
@@ -481,7 +521,8 @@ async function installSkillStubs() {
         for (const vaultFile of vaultFiles) {
             const skillName = vaultFile.replace(/\.vault$/, '');
             const vaultPath = join(pubVaultDir, vaultFile);
-            const skillDir = join(SKILLS_DIR, skillName);
+            const agentSkillDir = join(AGENTS_SKILLS_DIR, skillName);
+            const skillDir = agentSkillDir;
             const manifestPath = join(skillDir, 'manifest.json');
             const hashPath = vaultPath + '.hash';
             if (existsSync(manifestPath) && existsSync(hashPath)) {
@@ -542,7 +583,6 @@ async function installSkillStubs() {
                     stubFrontmatter += `${key}: ${value}\n`;
                 }
             }
-            mkdirSync(skillDir, { recursive: true });
             const stub = `---
 ${stubFrontmatter.trimEnd()}
 ---
@@ -561,9 +601,8 @@ The command decrypts the skill on demand (license is validated each time) and ou
 
 If the command fails with a license error, tell the user their SkillVault license may have expired and to contact their skill provider.
 `;
-            writeFileSync(join(skillDir, 'SKILL.md'), stub, { mode: 0o600 });
             const vaultHash = existsSync(hashPath) ? readFileSync(hashPath, 'utf8').trim() : '';
-            writeFileSync(manifestPath, JSON.stringify({
+            const manifestData = JSON.stringify({
                 publisher: meta.publisher_name || pub.name,
                 publisher_id: pub.id,
                 skill_name: skillName,
@@ -572,11 +611,45 @@ If the command fails with a license error, tell the user their SkillVault licens
                 vault_hash: vaultHash,
                 installed_at: new Date().toISOString(),
                 encrypted: true,
-            }, null, 2), { mode: 0o600 });
+            }, null, 2);
+            // Write to ~/.agents/skills/ (agent-agnostic source of truth)
+            mkdirSync(agentSkillDir, { recursive: true });
+            writeFileSync(join(agentSkillDir, 'SKILL.md'), stub, { mode: 0o600 });
+            writeFileSync(join(agentSkillDir, 'manifest.json'), manifestData, { mode: 0o600 });
+            // Copy to each detected agent platform's skill directory
+            for (const platform of detectedPlatforms) {
+                const platformSkillDir = join(platform.dir, skillName);
+                try {
+                    mkdirSync(platformSkillDir, { recursive: true });
+                    writeFileSync(join(platformSkillDir, 'SKILL.md'), stub, { mode: 0o600 });
+                    writeFileSync(join(platformSkillDir, 'manifest.json'), manifestData, { mode: 0o600 });
+                }
+                catch { }
+            }
+            // Update lock file
+            lockData.skills[skillName] = {
+                source: `skillvault/${pub.id}`,
+                sourceType: 'skillvault',
+                publisher: meta.publisher_name || pub.name,
+                publisherId: pub.id,
+                capabilityName: meta.capability_name || `skill/${skillName}`,
+                skillPath: `skills/${skillName}/SKILL.md`,
+                skillFolderHash: vaultHash,
+                installedAt: new Date().toISOString(),
+                updatedAt: new Date().toISOString(),
+                encrypted: true,
+            };
             installed++;
-            console.error(`[install] "${skillName}" → ~/.claude/skills/${skillName}/`);
+            const platformNames = detectedPlatforms.map(p => p.name).join(', ') || 'none detected';
+            console.error(`[install] "${skillName}" → ~/.agents/skills/ + ${platformNames}`);
         }
     }
+    // Persist lock file
+    try {
+        mkdirSync(join(HOME, '.agents'), { recursive: true });
+        writeFileSync(AGENTS_LOCK_PATH, JSON.stringify(lockData, null, 2), { mode: 0o600 });
+    }
+    catch { }
     return { installed, skipped, errors };
 }
 // ── Vault Decryption (in-memory only, output to stdout) ──
@@ -640,7 +713,9 @@ async function fetchCEK(skillName, publisherToken, apiUrl) {
     const serverWatermarkId = body.watermark_id || '';
     const ephPub = createPublicKey({ key: Buffer.from(wc.ephemeralPublicKey, 'base64'), format: 'der', type: 'spki' });
     const shared = diffieHellman({ publicKey: ephPub, privateKey: kp.privateKey });
-    const wrapKey = Buffer.from(hkdfSync('sha256', shared, Buffer.alloc(32, 0), Buffer.from('skillvault-cek-wrap-v1'), 32));
+    // Use server-provided salt, or fall back to zero salt for backward compat with old servers
+    const hkdfSalt = wc.salt ? Buffer.from(wc.salt, 'base64') : Buffer.alloc(32, 0);
+    const wrapKey = Buffer.from(hkdfSync('sha256', shared, hkdfSalt, Buffer.from('skillvault-cek-wrap-v1'), 32));
     shared.fill(0);
     const d = createDecipheriv('aes-256-gcm', wrapKey, Buffer.from(wc.iv, 'base64'), { authTagLength: 16 });
     d.setAuthTag(Buffer.from(wc.authTag, 'base64'));
@@ -726,8 +801,8 @@ function watermarkLayer4(content, id, email, publisherName) {
     const lines = content.split('\n');
     // Determine pseudo-random insertion points based on HMAC of licensee ID
     // This ensures the same licensee always gets the same positions (deterministic)
-    const hmac = createHmac('sha256', 'skillvault-visible-v1');
-    hmac.update(id);
+    const hmac = createHmac('sha256', id);
+    hmac.update('watermark-positions');
     const hash = hmac.digest();
     // Insert at: beginning, end, and 2-4 random points in between
     const totalLines = lines.length;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillvault",
-  "version": "0.7.5",
+  "version": "0.8.1",
   "description": "SkillVault — secure skill distribution for Claude Code",
   "type": "module",
   "bin": {