skillverse 0.1.5 → 0.1.8

package/dist/bin.js

@@ -785,6 +785,32 @@ var init_skillService = __esm({
           });
         }
       }
+      /**
+       * Sync skills between filesystem and database:
+       * 1. Remove orphaned database records (skills in DB but not on disk)
+       * 2. Import new skills from disk (skills on disk but not in DB)
+       */
+      async syncSkillsWithFileSystem() {
+        const { skills: skillsDir } = getPaths();
+        const dbSkills = await prisma.skill.findMany();
+        let removedCount = 0;
+        for (const skill of dbSkills) {
+          if (!existsSync3(skill.storagePath)) {
+            console.log(`\u{1F5D1}\uFE0F Removing orphaned skill from database: ${skill.name} (path: ${skill.storagePath})`);
+            try {
+              await prisma.skill.delete({ where: { id: skill.id } });
+              removedCount++;
+            } catch (error) {
+              console.error(`Failed to remove orphaned skill ${skill.name}:`, error);
+            }
+          }
+        }
+        if (removedCount > 0) {
+          console.log(`\u2705 Removed ${removedCount} orphaned skill(s) from database.`);
+        }
+        const importedCount = await this.scanForSkills();
+        return { removedCount, importedCount: importedCount || 0 };
+      }
       async scanForSkills() {
         const { skills: skillsDir } = getPaths();
         console.log(`Scanning for skills in ${skillsDir}...`);
@@ -1151,7 +1177,7 @@ ${relativeSkillsPath}/
         if (!existsSync4(skillsPath)) {
           return [];
         }
-        const { readdir: readdir2, stat: stat2, readFile: readFile3 } = await import("fs/promises");
+        const { readdir: readdir2, stat: stat2, readFile: readFile4 } = await import("fs/promises");
         const items = await readdir2(skillsPath);
         const existingSkills = [];
         for (const item of items) {
@@ -1192,7 +1218,7 @@ ${relativeSkillsPath}/
         if (!existsSync4(SKILLS_DIR)) {
           await mkdir2(SKILLS_DIR, { recursive: true });
         }
-        const { rename, readFile: readFile3, cp: cp2 } = await import("fs/promises");
+        const { rename, readFile: readFile4, cp: cp2 } = await import("fs/promises");
         const migrated = [];
         const errors = [];
         for (const skillName of skillNames) {
@@ -1225,7 +1251,7 @@ ${relativeSkillsPath}/
             if (existsSync4(skillMdPath)) {
               try {
                 const matter2 = await import("gray-matter");
-                const fileContent = await readFile3(skillMdPath, "utf-8");
+                const fileContent = await readFile4(skillMdPath, "utf-8");
                 const parsed = matter2.default(fileContent);
                 description = parsed.data.description || "";
                 metadata = parsed.data;
@@ -1320,6 +1346,18 @@ var init_skills = __esm({
         next(error);
       }
     });
+    router.post("/sync", async (req, res, next) => {
+      try {
+        const result = await skillService.syncSkillsWithFileSystem();
+        res.json({
+          success: true,
+          data: result,
+          message: `Synced: removed ${result.removedCount} orphan(s), imported ${result.importedCount} new skill(s)`
+        });
+      } catch (error) {
+        next(error);
+      }
+    });
     router.get("/:id", async (req, res, next) => {
       try {
         const skill = await skillService.getSkillById(req.params.id);
@@ -1496,7 +1534,7 @@ var init_skills = __esm({
     });
     router.get("/:id/skill-md", async (req, res, next) => {
       try {
-        const { readFile: readFile3 } = await import("fs/promises");
+        const { readFile: readFile4 } = await import("fs/promises");
         const skill = await skillService.getSkillById(req.params.id);
         const skillMdPath = join5(skill.storagePath, "SKILL.md");
         if (!existsSync5(skillMdPath)) {
@@ -1508,7 +1546,7 @@ var init_skills = __esm({
             }
           });
         }
-        const content = await readFile3(skillMdPath, "utf-8");
+        const content = await readFile4(skillMdPath, "utf-8");
         res.json({
           success: true,
           data: {
@@ -1766,52 +1804,300 @@ var init_bundleService = __esm({
   }
 });
 
+// src/services/githubMarketplaceRegistry.ts
+import { Buffer as Buffer2 } from "buffer";
+import { createHash } from "crypto";
+import { readFile as readFile3 } from "fs/promises";
+function sha256Hex(buf) {
+  return createHash("sha256").update(buf).digest("hex");
+}
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function normalizeIndex(index) {
+  const base = {
+    version: typeof index?.version === "number" ? index.version : 1,
+    updatedAt: typeof index?.updatedAt === "string" ? index.updatedAt : nowIso(),
+    skills: Array.isArray(index?.skills) ? index.skills : []
+  };
+  return base;
+}
+async function requireOctokit() {
+  const mod = await import("octokit");
+  return mod.Octokit;
+}
+var GitHubMarketplaceRegistry;
+var init_githubMarketplaceRegistry = __esm({
+  "src/services/githubMarketplaceRegistry.ts"() {
+    "use strict";
+    GitHubMarketplaceRegistry = class {
+      constructor(cfg) {
+        this.cfg = cfg;
+      }
+      getIndexPath() {
+        return this.cfg.indexPath || "index.json";
+      }
+      async octokit() {
+        const Octokit = await requireOctokit();
+        return new Octokit({ auth: this.cfg.token });
+      }
+      async fetchIndexFromPages() {
+        const resp = await fetch(this.cfg.indexUrl, { method: "GET" });
+        if (!resp.ok) {
+          throw new Error(`Failed to fetch marketplace index from Pages: ${resp.status} ${resp.statusText}`);
+        }
+        const json = await resp.json();
+        return normalizeIndex(json);
+      }
+      async readIndexFromRepo() {
+        const octokit = await this.octokit();
+        const path = this.getIndexPath();
+        const res = await octokit.rest.repos.getContent({
+          owner: this.cfg.owner,
+          repo: this.cfg.repo,
+          path,
+          ref: this.cfg.branch
+        });
+        if (Array.isArray(res.data) || res.data.type !== "file") {
+          throw new Error(`Invalid index path in repo: ${path}`);
+        }
+        const content = Buffer2.from(res.data.content, res.data.encoding).toString("utf-8");
+        const parsed = JSON.parse(content);
+        return { index: normalizeIndex(parsed), sha: res.data.sha };
+      }
+      async upsertIndexToRepo(index, previousSha) {
+        const octokit = await this.octokit();
+        const path = this.getIndexPath();
+        const body = JSON.stringify(
+          {
+            ...index,
+            updatedAt: nowIso()
+          },
+          null,
+          2
+        );
+        const contentBase64 = Buffer2.from(body, "utf-8").toString("base64");
+        await octokit.rest.repos.createOrUpdateFileContents({
+          owner: this.cfg.owner,
+          repo: this.cfg.repo,
+          branch: this.cfg.branch,
+          path,
+          message: `chore(marketplace): update ${path}`,
+          content: contentBase64,
+          ...previousSha ? { sha: previousSha } : {}
+        });
+      }
+      async createReleaseWithAsset(params) {
+        const octokit = await this.octokit();
+        const bundleBuf = await readFile3(params.bundlePath);
+        const sha256 = sha256Hex(bundleBuf);
+        const bundleSize = bundleBuf.byteLength;
+        const safeName = params.skillName.replace(/[^a-zA-Z0-9._-]/g, "-");
+        const safeVer = params.skillVersion.replace(/[^a-zA-Z0-9._-]/g, "-");
+        const tag = `skillverse-marketplace/${safeName}/v${safeVer}/${Date.now()}`;
+        const release = await octokit.rest.repos.createRelease({
+          owner: this.cfg.owner,
+          repo: this.cfg.repo,
+          tag_name: tag,
+          name: `SkillVerse Marketplace: ${params.skillName}@${params.skillVersion}`,
+          body: params.description || "",
+          draft: false,
+          prerelease: false,
+          target_commitish: this.cfg.branch
+        });
+        const assetName = `${safeName}-${safeVer}.tar.gz`;
+        const uploadRes = await octokit.rest.repos.uploadReleaseAsset({
+          owner: this.cfg.owner,
+          repo: this.cfg.repo,
+          release_id: release.data.id,
+          name: assetName,
+          data: bundleBuf,
+          headers: {
+            "content-type": "application/gzip",
+            "content-length": bundleSize
+          }
+        });
+        return {
+          bundleUrl: uploadRes.data.browser_download_url,
+          bundleSize,
+          sha256,
+          tag
+        };
+      }
+      upsertSkillEntry(index, entry) {
+        const createdAt = nowIso();
+        const existingIdx = index.skills.findIndex((s) => s?.name === entry.name && s?.type === entry.type);
+        if (existingIdx >= 0) {
+          const prev = index.skills[existingIdx];
+          index.skills[existingIdx] = {
+            ...prev,
+            ...entry,
+            updatedAt: nowIso(),
+            createdAt: prev.createdAt || createdAt
+          };
+        } else {
+          index.skills.push({
+            ...entry,
+            createdAt,
+            updatedAt: nowIso()
+          });
+        }
+        return index;
+      }
+      static stableIdForEntry(entry) {
+        const key = entry.type === "git" ? `git:${entry.name}:${entry.gitUrl}` : `bundle:${entry.name}:${entry.skillVersion || ""}:${entry.bundleUrl}`;
+        return createHash("sha256").update(key).digest("hex").slice(0, 24);
+      }
+      async deleteReleaseByTag(tag) {
+        const octokit = await this.octokit();
+        let releaseId;
+        let page = 1;
+        const perPage = 30;
+        while (!releaseId) {
+          const { data: releases } = await octokit.rest.repos.listReleases({
+            owner: this.cfg.owner,
+            repo: this.cfg.repo,
+            page,
+            per_page: perPage
+          });
+          if (releases.length === 0) break;
+          const found = releases.find((r) => r.tag_name === tag);
+          if (found) {
+            releaseId = found.id;
+            break;
+          }
+          page++;
+        }
+        if (!releaseId) {
+          console.warn(`Release with tag "${tag}" not found, skipping deletion.`);
+          return;
+        }
+        await octokit.rest.repos.deleteRelease({
+          owner: this.cfg.owner,
+          repo: this.cfg.repo,
+          release_id: releaseId
+        });
+        try {
+          await octokit.rest.git.deleteRef({
+            owner: this.cfg.owner,
+            repo: this.cfg.repo,
+            ref: `tags/${tag}`
+          });
+        } catch (e) {
+          console.warn(`Failed to delete git tag ref "tags/${tag}":`, e.message);
+        }
+      }
+    };
+  }
+});
+
+// src/marketplaceConfig.ts
+var marketplaceConfig;
+var init_marketplaceConfig = __esm({
+  "src/marketplaceConfig.ts"() {
+    "use strict";
+    marketplaceConfig = {
+      indexUrl: "https://fdksd.github.io/skillverse-marketplace/index.json",
+      owner: "fdksd",
+      repo: "skillverse-marketplace",
+      branch: "main",
+      token: "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"
+    };
+  }
+});
+
 // src/routes/marketplace.ts
 import { Router as Router3 } from "express";
 import { existsSync as existsSync7 } from "fs";
+import { join as join7 } from "path";
+import { mkdir as mkdir5, rm as rm5, writeFile } from "fs/promises";
+function requireMarketplaceGitHubConfig() {
+  const { indexUrl, owner, repo, branch, token } = marketplaceConfig;
+  if (!indexUrl) {
+    throw new AppError(
+      ErrorCode.VALIDATION_ERROR,
+      "Marketplace indexUrl is not configured.",
+      400
+    );
+  }
+  return {
+    indexUrl,
+    owner,
+    repo,
+    branch,
+    token,
+    indexPath: "index.json"
+  };
+}
+function mapIndexToMarketplaceItems(index, search) {
+  const query = (search || "").trim().toLowerCase();
+  const skills = index.skills || [];
+  const filtered = query ? skills.filter((s) => {
+    const name = String(s?.name || "").toLowerCase();
+    const desc = String(s?.description || "").toLowerCase();
+    return name.includes(query) || desc.includes(query);
+  }) : skills;
+  return filtered.map((entry) => {
+    const id = GitHubMarketplaceRegistry.stableIdForEntry(entry);
+    const publishDate = entry.createdAt || entry.updatedAt || index.updatedAt || (/* @__PURE__ */ new Date()).toISOString();
+    return {
+      id,
+      skillId: id,
+      publisherId: void 0,
+      publisherName: entry.publisherName || "Anonymous",
+      publishDate: new Date(publishDate),
+      downloads: entry.downloads || 0,
+      skill: {
+        id,
+        name: entry.name,
+        source: entry.type === "git" ? "git" : "local",
+        sourceUrl: entry.type === "git" ? entry.gitUrl : void 0,
+        description: entry.description || "",
+        commitHash: void 0,
+        repoUrl: entry.type === "git" ? entry.gitUrl : void 0,
+        updateAvailable: false,
+        lastUpdateCheck: void 0,
+        installDate: new Date(publishDate),
+        metadata: {
+          marketplace: entry
+        }
+      }
+    };
+  });
+}
+async function fetchIndex() {
+  const ghCfg = requireMarketplaceGitHubConfig();
+  const registry = new GitHubMarketplaceRegistry(ghCfg);
+  return await registry.fetchIndexFromPages();
+}
 var router3, marketplace_default;
 var init_marketplace = __esm({
   "src/routes/marketplace.ts"() {
     "use strict";
-    init_db();
     init_skillService();
     init_bundleService();
     init_errorHandler();
     init_dist();
+    init_db();
+    init_githubMarketplaceRegistry();
+    init_marketplaceConfig();
     router3 = Router3();
     router3.get("/skills", async (req, res, next) => {
       try {
         const { search, page = "1", pageSize = "20" } = req.query;
-        const where = {};
-        if (search) {
-          where.skill = {
-            OR: [
-              { name: { contains: search } },
-              { description: { contains: search } }
-            ]
-          };
-        }
-        const [items, total] = await Promise.all([
-          prisma.marketplaceSkill.findMany({
-            where,
-            include: {
-              skill: true
-            },
-            orderBy: {
-              downloads: "desc"
-            },
-            skip: (parseInt(page) - 1) * parseInt(pageSize),
-            take: parseInt(pageSize)
-          }),
-          prisma.marketplaceSkill.count({ where })
-        ]);
+        const index = await fetchIndex();
+        const allItems = mapIndexToMarketplaceItems(index, search);
+        const p = parseInt(page);
+        const ps = parseInt(pageSize);
+        const total = allItems.length;
+        const items = allItems.slice((p - 1) * ps, (p - 1) * ps + ps);
         res.json({
           success: true,
           data: {
             items,
             total,
-            page: parseInt(page),
-            pageSize: parseInt(pageSize)
+            page: p,
+            pageSize: ps
           }
         });
       } catch (error) {
@@ -1820,12 +2106,9 @@ var init_marketplace = __esm({
     });
     router3.get("/skills/:id", async (req, res, next) => {
       try {
-        const marketplaceSkill = await prisma.marketplaceSkill.findUnique({
-          where: { id: req.params.id },
-          include: {
-            skill: true
-          }
-        });
+        const index = await fetchIndex();
+        const items = mapIndexToMarketplaceItems(index);
+        const marketplaceSkill = items.find((i) => i.id === req.params.id);
         if (!marketplaceSkill) {
           throw new AppError(ErrorCode.NOT_FOUND, "Marketplace skill not found", 404);
         }
@@ -1839,33 +2122,48 @@ var init_marketplace = __esm({
     });
     router3.get("/download/:id", async (req, res, next) => {
       try {
-        const marketplaceSkill = await prisma.marketplaceSkill.findUnique({
-          where: { id: req.params.id },
-          include: {
-            skill: true
+        const ghCfg = requireMarketplaceGitHubConfig();
+        const registry = new GitHubMarketplaceRegistry(ghCfg);
+        let index;
+        let sha;
+        try {
+          const result = await registry.readIndexFromRepo();
+          index = result.index;
+          sha = result.sha;
+        } catch (e) {
+          console.warn("Failed to read index from repo, falling back to cached:", e);
+          index = await fetchIndex();
+        }
+        const entryIndex = (index.skills || []).findIndex(
+          (s) => GitHubMarketplaceRegistry.stableIdForEntry(s) === req.params.id
+        );
+        const entry = entryIndex >= 0 ? index.skills[entryIndex] : void 0;
+        if (!entry) throw new AppError(ErrorCode.NOT_FOUND, "Marketplace skill not found", 404);
+        if (sha) {
+          try {
+            entry.downloads = (entry.downloads || 0) + 1;
+            index.skills[entryIndex] = entry;
+            await registry.upsertIndexToRepo(index, sha);
+          } catch (e) {
+            console.warn("Failed to update download count:", e);
           }
-        });
-        if (!marketplaceSkill) {
-          throw new AppError(ErrorCode.NOT_FOUND, "Marketplace skill not found", 404);
         }
-        if (marketplaceSkill.skill.source === "git" && marketplaceSkill.skill.sourceUrl) {
+        if (entry.type === "git") {
           return res.json({
             success: true,
-            data: {
-              type: "git",
-              sourceUrl: marketplaceSkill.skill.sourceUrl
-            }
+            data: { type: "git", sourceUrl: entry.gitUrl }
           });
         }
-        if (marketplaceSkill.bundlePath && existsSync7(marketplaceSkill.bundlePath)) {
-          res.setHeader("Content-Type", "application/gzip");
-          res.setHeader(
-            "Content-Disposition",
-            `attachment; filename="${marketplaceSkill.skill.name}.tar.gz"`
-          );
-          return res.sendFile(marketplaceSkill.bundlePath);
-        }
-        throw new AppError(ErrorCode.NOT_FOUND, "Bundle not available for this skill", 404);
+        return res.json({
+          success: true,
+          data: {
+            type: "bundle",
+            bundleUrl: entry.bundleUrl,
+            bundleSize: entry.bundleSize,
+            sha256: entry.sha256,
+            skillVersion: entry.skillVersion
+          }
+        });
       } catch (error) {
         next(error);
       }
@@ -1879,38 +2177,74 @@ var init_marketplace = __esm({
             error: "skillId is required"
           });
         }
-        const skill = await prisma.skill.findUnique({
-          where: { id: skillId }
-        });
-        if (!skill) {
-          throw new AppError(ErrorCode.NOT_FOUND, "Skill not found", 404);
-        }
-        const existingEntry = await prisma.marketplaceSkill.findUnique({
-          where: { skillId }
-        });
-        if (existingEntry) {
-          throw new AppError(ErrorCode.ALREADY_EXISTS, "Skill is already published to marketplace", 409);
-        }
-        let bundlePath = null;
-        let bundleSize = null;
-        if (skill.source === "local" && existsSync7(skill.storagePath)) {
-          bundlePath = await bundleService.createBundle(skill.storagePath, skill.name);
-          bundleSize = await bundleService.getBundleSize(bundlePath);
+        const skill = await skillService.getSkillById(skillId);
+        const ghCfg = requireMarketplaceGitHubConfig();
+        if (!ghCfg.owner || !ghCfg.repo || !ghCfg.branch || !ghCfg.token) {
+          throw new AppError(
+            ErrorCode.VALIDATION_ERROR,
+            "GitHub registry config is incomplete. Please set owner/repo/branch/token in Settings -> Marketplace.",
+            400
+          );
         }
-        const marketplaceSkill = await prisma.marketplaceSkill.create({
-          data: {
-            skillId,
+        const registry = new GitHubMarketplaceRegistry(ghCfg);
+        const { index, sha } = await registry.readIndexFromRepo();
+        if (skill.source === "git") {
+          if (!skill.sourceUrl) {
+            throw new AppError(ErrorCode.VALIDATION_ERROR, "Git skill is missing sourceUrl", 400);
+          }
+          registry.upsertSkillEntry(index, {
+            type: "git",
+            name: skill.name,
+            description: skill.description || "",
             publisherName: publisherName || "Anonymous",
+            gitUrl: skill.sourceUrl
+          });
+        } else {
+          if (!existsSync7(skill.storagePath)) {
+            throw new AppError(ErrorCode.FILE_SYSTEM_ERROR, "Skill files not found on disk", 400);
+          }
+          const bundlePath = await bundleService.createBundle(skill.storagePath, skill.name);
+          const parsedMeta = (() => {
+            try {
+              return skill.metadata ? JSON.parse(skill.metadata) : {};
+            } catch {
+              return {};
+            }
+          })();
+          const skillVersion = String(parsedMeta.version || parsedMeta.skillVersion || "1.0.0");
+          const uploaded = await registry.createReleaseWithAsset({
+            skillName: skill.name,
+            skillVersion,
             bundlePath,
-            bundleSize
+            description: skill.description || ""
+          });
+          registry.upsertSkillEntry(index, {
+            type: "bundle",
+            name: skill.name,
+            description: skill.description || "",
+            publisherName: publisherName || "Anonymous",
+            bundleUrl: uploaded.bundleUrl,
+            bundleSize: uploaded.bundleSize,
+            sha256: uploaded.sha256,
+            skillVersion
+          });
+        }
+        await registry.upsertIndexToRepo(index, sha);
+        await prisma.marketplaceSkill.upsert({
+          where: { skillId: skill.id },
+          create: {
+            skillId: skill.id,
+            publisherName: publisherName || "Anonymous",
+            downloads: 0
           },
-          include: {
-            skill: true
+          update: {
+            publisherName: publisherName || "Anonymous",
+            updatedAt: /* @__PURE__ */ new Date()
           }
         });
         res.status(201).json({
           success: true,
-          data: marketplaceSkill,
+          data: { ok: true },
           message: "Skill published to marketplace successfully"
         });
       } catch (error) {
@@ -1919,66 +2253,117 @@ var init_marketplace = __esm({
     });
     router3.post("/install/:id", async (req, res, next) => {
       try {
-        const marketplaceSkill = await prisma.marketplaceSkill.findUnique({
-          where: { id: req.params.id },
-          include: {
-            skill: true
+        const ghCfg = requireMarketplaceGitHubConfig();
+        const registry = new GitHubMarketplaceRegistry(ghCfg);
+        let index;
+        let sha;
+        try {
+          const result = await registry.readIndexFromRepo();
+          index = result.index;
+          sha = result.sha;
+        } catch (e) {
+          console.warn("Failed to read index from repo for install count:", e);
+          index = await fetchIndex();
+        }
+        const entryIndex = (index.skills || []).findIndex(
+          (s) => GitHubMarketplaceRegistry.stableIdForEntry(s) === req.params.id
+        );
+        const entry = entryIndex >= 0 ? index.skills[entryIndex] : void 0;
+        if (!entry) throw new AppError(ErrorCode.NOT_FOUND, "Marketplace skill not found", 404);
+        if (sha) {
+          try {
+            entry.downloads = (entry.downloads || 0) + 1;
+            index.skills[entryIndex] = entry;
+            await registry.upsertIndexToRepo(index, sha);
+          } catch (e) {
+            console.warn("Failed to update download count:", e);
           }
-        });
-        if (!marketplaceSkill) {
-          throw new AppError(ErrorCode.NOT_FOUND, "Marketplace skill not found", 404);
         }
-        const sourceSkill = marketplaceSkill.skill;
-        if (sourceSkill.source === "git" && sourceSkill.sourceUrl) {
-          const newSkill = await skillService.createSkillFromGit(
-            sourceSkill.sourceUrl,
-            sourceSkill.description || void 0
-          );
-          await prisma.marketplaceSkill.update({
-            where: { id: req.params.id },
-            data: { downloads: { increment: 1 } }
-          });
+        if (entry.type === "git") {
+          const newSkill = await skillService.createSkillFromGit(entry.gitUrl, entry.description || void 0);
           return res.status(201).json({
             success: true,
             data: newSkill,
             message: "Skill installed from marketplace successfully"
           });
         }
-        if (sourceSkill.source === "local" && marketplaceSkill.bundlePath && existsSync7(marketplaceSkill.bundlePath)) {
+        const tempDir = process.env.TEMP_DIR || join7(process.env.HOME || "", ".skillverse", "temp");
+        await mkdir5(tempDir, { recursive: true });
+        const resp = await fetch(entry.bundleUrl);
+        if (!resp.ok) {
+          throw new AppError(
+            ErrorCode.INTERNAL_ERROR,
+            `Failed to download bundle: ${resp.status} ${resp.statusText}`,
+            502
+          );
+        }
+        const buf = Buffer.from(await resp.arrayBuffer());
+        const tmpPath = join7(tempDir, `marketplace-${entry.name}-${Date.now()}.tar.gz`);
+        await writeFile(tmpPath, buf);
+        try {
           const newSkill = await skillService.createSkillFromBundle(
-            marketplaceSkill.bundlePath,
-            sourceSkill.name,
-            sourceSkill.description || void 0
+            tmpPath,
+            entry.name,
+            entry.description || void 0
           );
-          await prisma.marketplaceSkill.update({
-            where: { id: req.params.id },
-            data: { downloads: { increment: 1 } }
-          });
           return res.status(201).json({
             success: true,
             data: newSkill,
             message: "Skill installed from marketplace successfully"
           });
+        } finally {
+          await rm5(tmpPath, { force: true }).catch(() => {
+          });
         }
-        return res.status(400).json({
-          success: false,
-          error: "Cannot install this skill. Bundle not available."
-        });
       } catch (error) {
         next(error);
       }
     });
     router3.delete("/unpublish/:skillId", async (req, res, next) => {
       try {
-        const marketplaceSkill = await prisma.marketplaceSkill.findUnique({
-          where: { skillId: req.params.skillId }
+        const skill = await skillService.getSkillById(req.params.skillId);
+        const ghCfg = requireMarketplaceGitHubConfig();
+        if (!ghCfg.owner || !ghCfg.repo || !ghCfg.branch || !ghCfg.token) {
+          throw new AppError(
+            ErrorCode.VALIDATION_ERROR,
+            "GitHub registry config is incomplete. Please set owner/repo/branch/token in Settings -> Marketplace.",
+            400
+          );
+        }
+        const registry = new GitHubMarketplaceRegistry(ghCfg);
+        const { index, sha } = await registry.readIndexFromRepo();
+        const before = index.skills.length;
+        const entryToRemove = index.skills.find((s) => {
+          if (s?.name !== skill.name) return false;
+          if (skill.source === "git") return s.type === "git";
+          return s.type === "bundle";
         });
-        if (!marketplaceSkill) {
+        if (entryToRemove) {
+          if (entryToRemove.type === "bundle" && entryToRemove.bundleUrl) {
+            try {
+              const match = entryToRemove.bundleUrl.match(/\/releases\/download\/(.+)\/[^/]+$/);
+              if (match && match[1]) {
+                const tag = decodeURIComponent(match[1]);
+                console.log(`Deleting release tag: ${tag}`);
+                await registry.deleteReleaseByTag(tag);
+              }
+            } catch (e) {
+              console.warn("Failed to delete GitHub release:", e);
+            }
+          }
+          index.skills = index.skills.filter((s) => s !== entryToRemove);
+        }
+        const after = index.skills.length;
+        if (before === after) {
           throw new AppError(ErrorCode.NOT_FOUND, "Skill is not published to marketplace", 404);
         }
-        await prisma.marketplaceSkill.delete({
-          where: { id: marketplaceSkill.id }
-        });
+        await registry.upsertIndexToRepo(index, sha);
+        try {
+          await prisma.marketplaceSkill.delete({
+            where: { skillId: skill.id }
+          });
+        } catch (e) {
+        }
         res.json({
           success: true,
           message: "Skill unpublished from marketplace successfully"
@@ -2092,12 +2477,12 @@ var init_dashboard = __esm({
 
 // src/routes/config.ts
 import { Router as Router5 } from "express";
-import { join as join7 } from "path";
-import { existsSync as existsSync8, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { join as join8 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync3, writeFileSync } from "fs";
 function readConfig() {
   if (existsSync8(CONFIG_FILE)) {
     try {
-      return JSON.parse(readFileSync2(CONFIG_FILE, "utf-8"));
+      return JSON.parse(readFileSync3(CONFIG_FILE, "utf-8"));
     } catch (e) {
       console.error("Failed to read config.json:", e);
       return {};
@@ -2111,8 +2496,8 @@ var init_config2 = __esm({
     "use strict";
     router5 = Router5();
     HOME = process.env.HOME || process.env.USERPROFILE || "";
-    BOOTSTRAP_HOME = join7(HOME, ".skillverse");
-    CONFIG_FILE = join7(BOOTSTRAP_HOME, "config.json");
+    BOOTSTRAP_HOME = join8(HOME, ".skillverse");
+    CONFIG_FILE = join8(BOOTSTRAP_HOME, "config.json");
     router5.get("/", (req, res, next) => {
       try {
         const fileConfig = readConfig();
@@ -2120,8 +2505,17 @@ var init_config2 = __esm({
           // Show saved preference if available, otherwise current env/default
           skillverseHome: fileConfig.skillverseHome || process.env.SKILLVERSE_HOME || BOOTSTRAP_HOME,
           // registryUrl is potentially in config.json already
-          registryUrl: fileConfig.registryUrl || process.env.SKILLVERSE_REGISTRY || "http://localhost:4000"
-          // ... add other configurable items
+          registryUrl: fileConfig.registryUrl || process.env.SKILLVERSE_REGISTRY || "http://localhost:4000",
+          // Marketplace is now hardcoded
+          marketplace: {
+            indexUrl: "",
+            github: {
+              owner: "",
+              repo: "",
+              branch: "",
+              tokenConfigured: false
+            }
+          }
         };
         res.json({
           success: true,
@@ -2133,19 +2527,19 @@ var init_config2 = __esm({
     });
     router5.post("/", async (req, res, next) => {
       try {
-        const { skillverseHome, registryUrl, migrate } = req.body;
+        const { skillverseHome, registryUrl, migrate, marketplace } = req.body;
         const currentConfig = readConfig();
         const oldHome = process.env.SKILLVERSE_HOME || BOOTSTRAP_HOME;
         if (migrate && skillverseHome && skillverseHome !== oldHome) {
           console.log(`Migrating data from ${oldHome} to ${skillverseHome}...`);
           const { cp: cp2 } = await import("fs/promises");
           if (!existsSync8(skillverseHome)) {
-            const { mkdir: mkdir6 } = await import("fs/promises");
-            await mkdir6(skillverseHome, { recursive: true });
+            const { mkdir: mkdir7 } = await import("fs/promises");
+            await mkdir7(skillverseHome, { recursive: true });
           }
           const copyDir = async (srcName) => {
-            const src = join7(oldHome, srcName);
-            const dest = join7(skillverseHome, srcName);
+            const src = join8(oldHome, srcName);
+            const dest = join8(skillverseHome, srcName);
             if (existsSync8(src)) {
               console.log(`Copying ${srcName}...`);
               await cp2(src, dest, { recursive: true, force: true });
@@ -2153,8 +2547,8 @@ var init_config2 = __esm({
           };
           await copyDir("skills");
           await copyDir("marketplace");
-          const dbSrc = join7(oldHome, "skillverse.db");
-          const dbDest = join7(skillverseHome, "skillverse.db");
+          const dbSrc = join8(oldHome, "skillverse.db");
+          const dbDest = join8(skillverseHome, "skillverse.db");
           if (existsSync8(dbSrc)) {
             console.log("Copying database...");
             await cp2(dbSrc, dbDest, { force: true });
@@ -2164,8 +2558,8 @@ var init_config2 = __esm({
             if (existsSync8(shmSrc)) await cp2(shmSrc, dbDest + "-shm", { force: true });
             console.log("Updating skill paths in new database...");
             const { execSync } = await import("child_process");
-            const oldSkillsPath = join7(oldHome, "skills");
-            const newSkillsPath = join7(skillverseHome, "skills");
+            const oldSkillsPath = join8(oldHome, "skills");
+            const newSkillsPath = join8(skillverseHome, "skills");
             const updateQuery = `UPDATE Skill SET storagePath = replace(storagePath, '${oldSkillsPath}', '${newSkillsPath}') WHERE storagePath LIKE '${oldSkillsPath}%';`;
             try {
               execSync(`sqlite3 "${dbDest}" "${updateQuery}"`, { encoding: "utf-8" });
@@ -2175,21 +2569,79 @@ var init_config2 = __esm({
             }
           }
         }
-        const newConfig = {
+        const nextConfig = {
           ...currentConfig,
           ...skillverseHome && { skillverseHome },
           ...registryUrl && { registryUrl }
         };
-        writeFileSync(CONFIG_FILE, JSON.stringify(newConfig, null, 2));
+        writeFileSync(CONFIG_FILE, JSON.stringify(nextConfig, null, 2));
         res.json({
           success: true,
-          data: newConfig,
+          data: {
+            ...nextConfig,
+            // Never return token
+            marketplace: {
+              indexUrl: nextConfig.marketplace?.indexUrl || "",
+              github: {
+                owner: nextConfig.marketplace?.github?.owner || "",
+                repo: nextConfig.marketplace?.github?.repo || "",
+                branch: nextConfig.marketplace?.github?.branch || "main",
+                tokenConfigured: Boolean(nextConfig.marketplace?.github?.token)
+              }
+            }
+          },
           message: "Configuration saved. Restart server for changes to take effect."
         });
       } catch (error) {
         next(error);
       }
     });
+    router5.get("/version", async (req, res, next) => {
+      try {
+        const { dirname: dirname4, join: pathJoin } = await import("path");
+        const { fileURLToPath: fileURLToPath4 } = await import("url");
+        const __filename4 = fileURLToPath4(import.meta.url);
+        const __dirname4 = dirname4(__filename4);
+        const packageJsonPath = pathJoin(__dirname4, "..", "..", "package.json");
+        let currentVersion = "0.0.0";
+        if (existsSync8(packageJsonPath)) {
+          const pkg = JSON.parse(readFileSync3(packageJsonPath, "utf-8"));
+          currentVersion = pkg.version || "0.0.0";
+        }
+        let latestVersion = currentVersion;
+        let hasUpdate = false;
+        try {
+          const response = await fetch("https://registry.npmjs.org/skillverse/latest");
+          if (response.ok) {
+            const data = await response.json();
+            latestVersion = data.version || currentVersion;
+            const parseVersion = (v) => v.split(".").map((n) => parseInt(n, 10) || 0);
+            const current = parseVersion(currentVersion);
+            const latest = parseVersion(latestVersion);
+            for (let i = 0; i < 3; i++) {
+              if (latest[i] > current[i]) {
+                hasUpdate = true;
+                break;
+              } else if (latest[i] < current[i]) {
+                break;
+              }
+            }
+          }
+        } catch (fetchError) {
+          console.warn("Failed to check npm registry for updates:", fetchError);
+        }
+        res.json({
+          success: true,
+          data: {
+            currentVersion,
+            latestVersion,
+            hasUpdate
+          }
+        });
+      } catch (error) {
+        next(error);
+      }
+    });
     config_default = router5;
   }
 });
@@ -2218,17 +2670,17 @@ import express from "express";
 import cors from "cors";
 import dotenv2 from "dotenv";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname3, join as join8 } from "path";
-import { mkdir as mkdir5 } from "fs/promises";
+import { dirname as dirname3, join as join9 } from "path";
+import { mkdir as mkdir6 } from "fs/promises";
 import { existsSync as existsSync9 } from "fs";
 async function initializeStorage() {
-  const skillverseHome = process.env.SKILLVERSE_HOME || join8(process.env.HOME || "", ".skillverse");
-  const skillsDir = process.env.SKILLS_DIR || join8(skillverseHome, "skills");
-  const marketplaceDir = process.env.MARKETPLACE_DIR || join8(skillverseHome, "marketplace");
+  const skillverseHome = process.env.SKILLVERSE_HOME || join9(process.env.HOME || "", ".skillverse");
+  const skillsDir = process.env.SKILLS_DIR || join9(skillverseHome, "skills");
+  const marketplaceDir = process.env.MARKETPLACE_DIR || join9(skillverseHome, "marketplace");
   const dirs = [skillverseHome, skillsDir, marketplaceDir];
   for (const dir of dirs) {
     if (!existsSync9(dir)) {
-      await mkdir5(dir, { recursive: true });
+      await mkdir6(dir, { recursive: true });
       console.log(`Created directory: ${dir}`);
     }
   }
@@ -2237,13 +2689,13 @@ async function startServer(port = 3001) {
   try {
     await initializeStorage();
     await ensureDatabaseInitialized();
-    console.log("\u{1F50D} Scanning for existing skills...");
+    console.log("\u{1F50D} Syncing skills with filesystem...");
     const { skillService: skillService2 } = await Promise.resolve().then(() => (init_skillService(), skillService_exports));
-    await skillService2.scanForSkills();
+    await skillService2.syncSkillsWithFileSystem();
     return new Promise((resolve) => {
       app.listen(port, () => {
         console.log(`\u{1F680} SkillVerse server running on http://localhost:${port}`);
-        console.log(`\u{1F4C1} Storage: ${process.env.SKILLVERSE_HOME || join8(process.env.HOME || "", ".skillverse")}`);
+        console.log(`\u{1F4C1} Storage: ${process.env.SKILLVERSE_HOME || join9(process.env.HOME || "", ".skillverse")}`);
         resolve();
       });
     });
@@ -2274,13 +2726,13 @@ var init_index = __esm({
     app.use(express.urlencoded({ extended: true }));
     app.use(requestLogger);
     possiblePublicDirs = [
-      join8(__dirname3, "../public"),
+      join9(__dirname3, "../public"),
       // Production: dist/index.js -> public
-      join8(__dirname3, "../../public"),
+      join9(__dirname3, "../../public"),
       // Dev tsx might resolve here 
-      join8(process.cwd(), "public"),
+      join9(process.cwd(), "public"),
       // Fallback: relative to cwd
-      join8(process.cwd(), "server/public")
+      join9(process.cwd(), "server/public")
       // Fallback: from root
     ];
     publicDir = possiblePublicDirs.find((dir) => existsSync9(dir));
@@ -2300,7 +2752,7 @@ var init_index = __esm({
     });
     if (publicDir && existsSync9(publicDir)) {
       app.get("*", (req, res) => {
-        res.sendFile(join8(publicDir, "index.html"));
+        res.sendFile(join9(publicDir, "index.html"));
       });
     }
     app.use(errorHandler);
@@ -2317,12 +2769,12 @@ init_skillService();
 init_workspaceService();
 import { program } from "commander";
 import open from "open";
-import { existsSync as existsSync10, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { join as join10 } from "path";
 import readline from "readline";
 var { skillverseHome: SKILLVERSE_HOME } = config;
-var AUTH_FILE = join9(SKILLVERSE_HOME, "auth.json");
-var CONFIG_FILE2 = join9(SKILLVERSE_HOME, "config.json");
+var AUTH_FILE = join10(SKILLVERSE_HOME, "auth.json");
+var CONFIG_FILE2 = join10(SKILLVERSE_HOME, "config.json");
 program.hook("preAction", async (thisCommand, actionCommand) => {
   if (["list", "start", "install", "add", "remove", "import", "search"].includes(actionCommand.name())) {
     await ensureDatabaseInitialized();
@@ -2330,14 +2782,14 @@ program.hook("preAction", async (thisCommand, actionCommand) => {
 });
 function getRegistryUrl() {
   if (existsSync10(CONFIG_FILE2)) {
-    const config3 = JSON.parse(readFileSync3(CONFIG_FILE2, "utf-8"));
+    const config3 = JSON.parse(readFileSync4(CONFIG_FILE2, "utf-8"));
     return config3.registryUrl || "http://localhost:4000";
   }
   return process.env.SKILLVERSE_REGISTRY || "http://localhost:4000";
 }
 function getAuthToken() {
   if (existsSync10(AUTH_FILE)) {
-    const auth = JSON.parse(readFileSync3(AUTH_FILE, "utf-8"));
+    const auth = JSON.parse(readFileSync4(AUTH_FILE, "utf-8"));
     return auth.token || null;
   }
   return null;
@@ -2449,7 +2901,7 @@ program.command("publish [path]").description("Publish a skill to the Registry")
     const form = new FormData();
     form.append("name", skillName);
     if (options.description) form.append("description", options.description);
-    form.append("bundle", readFileSync3(bundlePath), {
+    form.append("bundle", readFileSync4(bundlePath), {
       filename: `${skillName}.tar.gz`,
       contentType: "application/gzip"
     });
@@ -2508,7 +2960,7 @@ program.command("search <query>").description("Search for skills in the Registry
   }
 });
 program.command("config").description("Configure SkillVerse settings").option("-r, --registry <url>", "Set default registry URL").action((options) => {
-  const config3 = existsSync10(CONFIG_FILE2) ? JSON.parse(readFileSync3(CONFIG_FILE2, "utf-8")) : {};
+  const config3 = existsSync10(CONFIG_FILE2) ? JSON.parse(readFileSync4(CONFIG_FILE2, "utf-8")) : {};
   if (options.registry) {
     config3.registryUrl = options.registry;
     writeFileSync2(CONFIG_FILE2, JSON.stringify(config3, null, 2));
@@ -2561,7 +3013,7 @@ program.command("install [gitUrl]").description("Install a skill from Git URL").
   }
 });
 program.command("add").description("Add a local skill").requiredOption("-p, --path <path>", "Path to skill directory").option("-a, --agent <agent>", "Link to agent workspace").action(async (options) => {
-  const sourcePath = options.path.startsWith("/") ? options.path : join9(process.cwd(), options.path);
+  const sourcePath = options.path.startsWith("/") ? options.path : join10(process.cwd(), options.path);
   if (!existsSync10(sourcePath)) {
     console.error(`\u274C Source path not found: ${sourcePath}`);
     process.exit(1);