skillverse 0.1.5 → 0.1.8

package/dist/index.js

@@ -713,6 +713,32 @@ var init_skillService = __esm({
           });
         }
       }
+      /**
+       * Sync skills between filesystem and database:
+       * 1. Remove orphaned database records (skills in DB but not on disk)
+       * 2. Import new skills from disk (skills on disk but not in DB)
+       */
+      async syncSkillsWithFileSystem() {
+        const { skills: skillsDir } = getPaths();
+        const dbSkills = await prisma.skill.findMany();
+        let removedCount = 0;
+        for (const skill of dbSkills) {
+          if (!existsSync2(skill.storagePath)) {
+            console.log(`\u{1F5D1}\uFE0F Removing orphaned skill from database: ${skill.name} (path: ${skill.storagePath})`);
+            try {
+              await prisma.skill.delete({ where: { id: skill.id } });
+              removedCount++;
+            } catch (error) {
+              console.error(`Failed to remove orphaned skill ${skill.name}:`, error);
+            }
+          }
+        }
+        if (removedCount > 0) {
+          console.log(`\u2705 Removed ${removedCount} orphaned skill(s) from database.`);
+        }
+        const importedCount = await this.scanForSkills();
+        return { removedCount, importedCount: importedCount || 0 };
+      }
       async scanForSkills() {
         const { skills: skillsDir } = getPaths();
         console.log(`Scanning for skills in ${skillsDir}...`);
@@ -790,8 +816,8 @@ import express from "express";
 import cors from "cors";
 import dotenv2 from "dotenv";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import { dirname as dirname3, join as join8 } from "path";
-import { mkdir as mkdir5 } from "fs/promises";
+import { dirname as dirname3, join as join9 } from "path";
+import { mkdir as mkdir6 } from "fs/promises";
 import { existsSync as existsSync9 } from "fs";
 
 // src/routes/skills.ts
@@ -1092,7 +1118,7 @@ ${relativeSkillsPath}/
     if (!existsSync3(skillsPath)) {
       return [];
     }
-    const { readdir: readdir2, stat: stat2, readFile: readFile3 } = await import("fs/promises");
+    const { readdir: readdir2, stat: stat2, readFile: readFile4 } = await import("fs/promises");
     const items = await readdir2(skillsPath);
     const existingSkills = [];
     for (const item of items) {
@@ -1133,7 +1159,7 @@ ${relativeSkillsPath}/
     if (!existsSync3(SKILLS_DIR)) {
       await mkdir2(SKILLS_DIR, { recursive: true });
     }
-    const { rename, readFile: readFile3, cp: cp2 } = await import("fs/promises");
+    const { rename, readFile: readFile4, cp: cp2 } = await import("fs/promises");
     const migrated = [];
     const errors = [];
     for (const skillName of skillNames) {
@@ -1166,7 +1192,7 @@ ${relativeSkillsPath}/
         if (existsSync3(skillMdPath)) {
           try {
             const matter2 = await import("gray-matter");
-            const fileContent = await readFile3(skillMdPath, "utf-8");
+            const fileContent = await readFile4(skillMdPath, "utf-8");
             const parsed = matter2.default(fileContent);
             description = parsed.data.description || "";
             metadata = parsed.data;
@@ -1248,6 +1274,18 @@ router.get("/", async (req, res, next) => {
     next(error);
   }
 });
+router.post("/sync", async (req, res, next) => {
+  try {
+    const result = await skillService.syncSkillsWithFileSystem();
+    res.json({
+      success: true,
+      data: result,
+      message: `Synced: removed ${result.removedCount} orphan(s), imported ${result.importedCount} new skill(s)`
+    });
+  } catch (error) {
+    next(error);
+  }
+});
 router.get("/:id", async (req, res, next) => {
   try {
     const skill = await skillService.getSkillById(req.params.id);
@@ -1424,7 +1462,7 @@ router.post("/:id/refresh-metadata", async (req, res, next) => {
 });
 router.get("/:id/skill-md", async (req, res, next) => {
   try {
-    const { readFile: readFile3 } = await import("fs/promises");
+    const { readFile: readFile4 } = await import("fs/promises");
     const skill = await skillService.getSkillById(req.params.id);
     const skillMdPath = join4(skill.storagePath, "SKILL.md");
     if (!existsSync4(skillMdPath)) {
@@ -1436,7 +1474,7 @@ router.get("/:id/skill-md", async (req, res, next) => {
         }
       });
     }
-    const content = await readFile3(skillMdPath, "utf-8");
+    const content = await readFile4(skillMdPath, "utf-8");
     res.json({
       success: true,
       data: {
@@ -1591,7 +1629,6 @@ router2.post("/:id/migrate-skills", async (req, res, next) => {
 var workspaces_default = router2;
 
 // src/routes/marketplace.ts
-init_db();
 init_skillService();
 import { Router as Router3 } from "express";
 
@@ -1678,41 +1715,278 @@ var bundleService = {
 // src/routes/marketplace.ts
 init_errorHandler();
 init_dist();
+init_db();
 import { existsSync as existsSync6 } from "fs";
+import { join as join6 } from "path";
+import { mkdir as mkdir5, rm as rm5, writeFile } from "fs/promises";
+
+// src/services/githubMarketplaceRegistry.ts
+import { Buffer as Buffer2 } from "buffer";
+import { createHash } from "crypto";
+import { readFile as readFile3 } from "fs/promises";
+function sha256Hex(buf) {
+  return createHash("sha256").update(buf).digest("hex");
+}
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function normalizeIndex(index) {
+  const base = {
+    version: typeof index?.version === "number" ? index.version : 1,
+    updatedAt: typeof index?.updatedAt === "string" ? index.updatedAt : nowIso(),
+    skills: Array.isArray(index?.skills) ? index.skills : []
+  };
+  return base;
+}
+async function requireOctokit() {
+  const mod = await import("octokit");
+  return mod.Octokit;
+}
+var GitHubMarketplaceRegistry = class {
+  constructor(cfg) {
+    this.cfg = cfg;
+  }
+  getIndexPath() {
+    return this.cfg.indexPath || "index.json";
+  }
+  async octokit() {
+    const Octokit = await requireOctokit();
+    return new Octokit({ auth: this.cfg.token });
+  }
+  async fetchIndexFromPages() {
+    const resp = await fetch(this.cfg.indexUrl, { method: "GET" });
+    if (!resp.ok) {
+      throw new Error(`Failed to fetch marketplace index from Pages: ${resp.status} ${resp.statusText}`);
+    }
+    const json = await resp.json();
+    return normalizeIndex(json);
+  }
+  async readIndexFromRepo() {
+    const octokit = await this.octokit();
+    const path = this.getIndexPath();
+    const res = await octokit.rest.repos.getContent({
+      owner: this.cfg.owner,
+      repo: this.cfg.repo,
+      path,
+      ref: this.cfg.branch
+    });
+    if (Array.isArray(res.data) || res.data.type !== "file") {
+      throw new Error(`Invalid index path in repo: ${path}`);
+    }
+    const content = Buffer2.from(res.data.content, res.data.encoding).toString("utf-8");
+    const parsed = JSON.parse(content);
+    return { index: normalizeIndex(parsed), sha: res.data.sha };
+  }
+  async upsertIndexToRepo(index, previousSha) {
+    const octokit = await this.octokit();
+    const path = this.getIndexPath();
+    const body = JSON.stringify(
+      {
+        ...index,
+        updatedAt: nowIso()
+      },
+      null,
+      2
+    );
+    const contentBase64 = Buffer2.from(body, "utf-8").toString("base64");
+    await octokit.rest.repos.createOrUpdateFileContents({
+      owner: this.cfg.owner,
+      repo: this.cfg.repo,
+      branch: this.cfg.branch,
+      path,
+      message: `chore(marketplace): update ${path}`,
+      content: contentBase64,
+      ...previousSha ? { sha: previousSha } : {}
+    });
+  }
+  async createReleaseWithAsset(params) {
+    const octokit = await this.octokit();
+    const bundleBuf = await readFile3(params.bundlePath);
+    const sha256 = sha256Hex(bundleBuf);
+    const bundleSize = bundleBuf.byteLength;
+    const safeName = params.skillName.replace(/[^a-zA-Z0-9._-]/g, "-");
+    const safeVer = params.skillVersion.replace(/[^a-zA-Z0-9._-]/g, "-");
+    const tag = `skillverse-marketplace/${safeName}/v${safeVer}/${Date.now()}`;
+    const release = await octokit.rest.repos.createRelease({
+      owner: this.cfg.owner,
+      repo: this.cfg.repo,
+      tag_name: tag,
+      name: `SkillVerse Marketplace: ${params.skillName}@${params.skillVersion}`,
+      body: params.description || "",
+      draft: false,
+      prerelease: false,
+      target_commitish: this.cfg.branch
+    });
+    const assetName = `${safeName}-${safeVer}.tar.gz`;
+    const uploadRes = await octokit.rest.repos.uploadReleaseAsset({
+      owner: this.cfg.owner,
+      repo: this.cfg.repo,
+      release_id: release.data.id,
+      name: assetName,
+      data: bundleBuf,
+      headers: {
+        "content-type": "application/gzip",
+        "content-length": bundleSize
+      }
+    });
+    return {
+      bundleUrl: uploadRes.data.browser_download_url,
+      bundleSize,
+      sha256,
+      tag
+    };
+  }
+  upsertSkillEntry(index, entry) {
+    const createdAt = nowIso();
+    const existingIdx = index.skills.findIndex((s) => s?.name === entry.name && s?.type === entry.type);
+    if (existingIdx >= 0) {
+      const prev = index.skills[existingIdx];
+      index.skills[existingIdx] = {
+        ...prev,
+        ...entry,
+        updatedAt: nowIso(),
+        createdAt: prev.createdAt || createdAt
+      };
+    } else {
+      index.skills.push({
+        ...entry,
+        createdAt,
+        updatedAt: nowIso()
+      });
+    }
+    return index;
+  }
+  static stableIdForEntry(entry) {
+    const key = entry.type === "git" ? `git:${entry.name}:${entry.gitUrl}` : `bundle:${entry.name}:${entry.skillVersion || ""}:${entry.bundleUrl}`;
+    return createHash("sha256").update(key).digest("hex").slice(0, 24);
+  }
+  async deleteReleaseByTag(tag) {
+    const octokit = await this.octokit();
+    let releaseId;
+    let page = 1;
+    const perPage = 30;
+    while (!releaseId) {
+      const { data: releases } = await octokit.rest.repos.listReleases({
+        owner: this.cfg.owner,
+        repo: this.cfg.repo,
+        page,
+        per_page: perPage
+      });
+      if (releases.length === 0) break;
+      const found = releases.find((r) => r.tag_name === tag);
+      if (found) {
+        releaseId = found.id;
+        break;
+      }
+      page++;
+    }
+    if (!releaseId) {
+      console.warn(`Release with tag "${tag}" not found, skipping deletion.`);
+      return;
+    }
+    await octokit.rest.repos.deleteRelease({
+      owner: this.cfg.owner,
+      repo: this.cfg.repo,
+      release_id: releaseId
+    });
+    try {
+      await octokit.rest.git.deleteRef({
+        owner: this.cfg.owner,
+        repo: this.cfg.repo,
+        ref: `tags/${tag}`
+      });
+    } catch (e) {
+      console.warn(`Failed to delete git tag ref "tags/${tag}":`, e.message);
+    }
+  }
+};
+
+// src/marketplaceConfig.ts
+var marketplaceConfig = {
+  indexUrl: "https://fdksd.github.io/skillverse-marketplace/index.json",
+  owner: "fdksd",
+  repo: "skillverse-marketplace",
+  branch: "main",
+  token: "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"
+};
+
+// src/routes/marketplace.ts
 var router3 = Router3();
+function requireMarketplaceGitHubConfig() {
+  const { indexUrl, owner, repo, branch, token } = marketplaceConfig;
+  if (!indexUrl) {
+    throw new AppError(
+      ErrorCode.VALIDATION_ERROR,
+      "Marketplace indexUrl is not configured.",
+      400
+    );
+  }
+  return {
+    indexUrl,
+    owner,
+    repo,
+    branch,
+    token,
+    indexPath: "index.json"
+  };
+}
+function mapIndexToMarketplaceItems(index, search) {
+  const query = (search || "").trim().toLowerCase();
+  const skills = index.skills || [];
+  const filtered = query ? skills.filter((s) => {
+    const name = String(s?.name || "").toLowerCase();
+    const desc = String(s?.description || "").toLowerCase();
+    return name.includes(query) || desc.includes(query);
+  }) : skills;
+  return filtered.map((entry) => {
+    const id = GitHubMarketplaceRegistry.stableIdForEntry(entry);
+    const publishDate = entry.createdAt || entry.updatedAt || index.updatedAt || (/* @__PURE__ */ new Date()).toISOString();
+    return {
+      id,
+      skillId: id,
+      publisherId: void 0,
+      publisherName: entry.publisherName || "Anonymous",
+      publishDate: new Date(publishDate),
+      downloads: entry.downloads || 0,
+      skill: {
+        id,
+        name: entry.name,
+        source: entry.type === "git" ? "git" : "local",
+        sourceUrl: entry.type === "git" ? entry.gitUrl : void 0,
+        description: entry.description || "",
+        commitHash: void 0,
+        repoUrl: entry.type === "git" ? entry.gitUrl : void 0,
+        updateAvailable: false,
+        lastUpdateCheck: void 0,
+        installDate: new Date(publishDate),
+        metadata: {
+          marketplace: entry
+        }
+      }
+    };
+  });
+}
+async function fetchIndex() {
+  const ghCfg = requireMarketplaceGitHubConfig();
+  const registry = new GitHubMarketplaceRegistry(ghCfg);
+  return await registry.fetchIndexFromPages();
+}
 router3.get("/skills", async (req, res, next) => {
   try {
     const { search, page = "1", pageSize = "20" } = req.query;
-    const where = {};
-    if (search) {
-      where.skill = {
-        OR: [
-          { name: { contains: search } },
-          { description: { contains: search } }
-        ]
-      };
-    }
-    const [items, total] = await Promise.all([
-      prisma.marketplaceSkill.findMany({
-        where,
-        include: {
-          skill: true
-        },
-        orderBy: {
-          downloads: "desc"
-        },
-        skip: (parseInt(page) - 1) * parseInt(pageSize),
-        take: parseInt(pageSize)
-      }),
-      prisma.marketplaceSkill.count({ where })
-    ]);
+    const index = await fetchIndex();
+    const allItems = mapIndexToMarketplaceItems(index, search);
+    const p = parseInt(page);
+    const ps = parseInt(pageSize);
+    const total = allItems.length;
+    const items = allItems.slice((p - 1) * ps, (p - 1) * ps + ps);
     res.json({
       success: true,
       data: {
         items,
         total,
-        page: parseInt(page),
-        pageSize: parseInt(pageSize)
+        page: p,
+        pageSize: ps
       }
     });
   } catch (error) {
@@ -1721,12 +1995,9 @@ router3.get("/skills", async (req, res, next) => {
 });
 router3.get("/skills/:id", async (req, res, next) => {
   try {
-    const marketplaceSkill = await prisma.marketplaceSkill.findUnique({
-      where: { id: req.params.id },
-      include: {
-        skill: true
-      }
-    });
+    const index = await fetchIndex();
+    const items = mapIndexToMarketplaceItems(index);
+    const marketplaceSkill = items.find((i) => i.id === req.params.id);
     if (!marketplaceSkill) {
       throw new AppError(ErrorCode.NOT_FOUND, "Marketplace skill not found", 404);
     }
@@ -1740,33 +2011,48 @@ router3.get("/skills/:id", async (req, res, next) => {
 });
 router3.get("/download/:id", async (req, res, next) => {
   try {
-    const marketplaceSkill = await prisma.marketplaceSkill.findUnique({
-      where: { id: req.params.id },
-      include: {
-        skill: true
+    const ghCfg = requireMarketplaceGitHubConfig();
+    const registry = new GitHubMarketplaceRegistry(ghCfg);
+    let index;
+    let sha;
+    try {
+      const result = await registry.readIndexFromRepo();
+      index = result.index;
+      sha = result.sha;
+    } catch (e) {
+      console.warn("Failed to read index from repo, falling back to cached:", e);
+      index = await fetchIndex();
+    }
+    const entryIndex = (index.skills || []).findIndex(
+      (s) => GitHubMarketplaceRegistry.stableIdForEntry(s) === req.params.id
+    );
+    const entry = entryIndex >= 0 ? index.skills[entryIndex] : void 0;
+    if (!entry) throw new AppError(ErrorCode.NOT_FOUND, "Marketplace skill not found", 404);
+    if (sha) {
+      try {
+        entry.downloads = (entry.downloads || 0) + 1;
+        index.skills[entryIndex] = entry;
+        await registry.upsertIndexToRepo(index, sha);
+      } catch (e) {
+        console.warn("Failed to update download count:", e);
       }
-    });
-    if (!marketplaceSkill) {
-      throw new AppError(ErrorCode.NOT_FOUND, "Marketplace skill not found", 404);
     }
-    if (marketplaceSkill.skill.source === "git" && marketplaceSkill.skill.sourceUrl) {
+    if (entry.type === "git") {
       return res.json({
         success: true,
-        data: {
-          type: "git",
-          sourceUrl: marketplaceSkill.skill.sourceUrl
-        }
+        data: { type: "git", sourceUrl: entry.gitUrl }
       });
     }
-    if (marketplaceSkill.bundlePath && existsSync6(marketplaceSkill.bundlePath)) {
-      res.setHeader("Content-Type", "application/gzip");
-      res.setHeader(
-        "Content-Disposition",
-        `attachment; filename="${marketplaceSkill.skill.name}.tar.gz"`
-      );
-      return res.sendFile(marketplaceSkill.bundlePath);
-    }
-    throw new AppError(ErrorCode.NOT_FOUND, "Bundle not available for this skill", 404);
+    return res.json({
+      success: true,
+      data: {
+        type: "bundle",
+        bundleUrl: entry.bundleUrl,
+        bundleSize: entry.bundleSize,
+        sha256: entry.sha256,
+        skillVersion: entry.skillVersion
+      }
+    });
   } catch (error) {
     next(error);
   }
@@ -1780,38 +2066,74 @@ router3.post("/publish", async (req, res, next) => {
         error: "skillId is required"
       });
     }
-    const skill = await prisma.skill.findUnique({
-      where: { id: skillId }
-    });
-    if (!skill) {
-      throw new AppError(ErrorCode.NOT_FOUND, "Skill not found", 404);
-    }
-    const existingEntry = await prisma.marketplaceSkill.findUnique({
-      where: { skillId }
-    });
-    if (existingEntry) {
-      throw new AppError(ErrorCode.ALREADY_EXISTS, "Skill is already published to marketplace", 409);
-    }
-    let bundlePath = null;
-    let bundleSize = null;
-    if (skill.source === "local" && existsSync6(skill.storagePath)) {
-      bundlePath = await bundleService.createBundle(skill.storagePath, skill.name);
-      bundleSize = await bundleService.getBundleSize(bundlePath);
+    const skill = await skillService.getSkillById(skillId);
+    const ghCfg = requireMarketplaceGitHubConfig();
+    if (!ghCfg.owner || !ghCfg.repo || !ghCfg.branch || !ghCfg.token) {
+      throw new AppError(
+        ErrorCode.VALIDATION_ERROR,
+        "GitHub registry config is incomplete. Please set owner/repo/branch/token in Settings -> Marketplace.",
+        400
+      );
     }
-    const marketplaceSkill = await prisma.marketplaceSkill.create({
-      data: {
-        skillId,
+    const registry = new GitHubMarketplaceRegistry(ghCfg);
+    const { index, sha } = await registry.readIndexFromRepo();
+    if (skill.source === "git") {
+      if (!skill.sourceUrl) {
+        throw new AppError(ErrorCode.VALIDATION_ERROR, "Git skill is missing sourceUrl", 400);
+      }
+      registry.upsertSkillEntry(index, {
+        type: "git",
+        name: skill.name,
+        description: skill.description || "",
         publisherName: publisherName || "Anonymous",
+        gitUrl: skill.sourceUrl
+      });
+    } else {
+      if (!existsSync6(skill.storagePath)) {
+        throw new AppError(ErrorCode.FILE_SYSTEM_ERROR, "Skill files not found on disk", 400);
+      }
+      const bundlePath = await bundleService.createBundle(skill.storagePath, skill.name);
+      const parsedMeta = (() => {
+        try {
+          return skill.metadata ? JSON.parse(skill.metadata) : {};
+        } catch {
+          return {};
+        }
+      })();
+      const skillVersion = String(parsedMeta.version || parsedMeta.skillVersion || "1.0.0");
+      const uploaded = await registry.createReleaseWithAsset({
+        skillName: skill.name,
+        skillVersion,
         bundlePath,
-        bundleSize
+        description: skill.description || ""
+      });
+      registry.upsertSkillEntry(index, {
+        type: "bundle",
+        name: skill.name,
+        description: skill.description || "",
+        publisherName: publisherName || "Anonymous",
+        bundleUrl: uploaded.bundleUrl,
+        bundleSize: uploaded.bundleSize,
+        sha256: uploaded.sha256,
+        skillVersion
+      });
+    }
+    await registry.upsertIndexToRepo(index, sha);
+    await prisma.marketplaceSkill.upsert({
+      where: { skillId: skill.id },
+      create: {
+        skillId: skill.id,
+        publisherName: publisherName || "Anonymous",
+        downloads: 0
       },
-      include: {
-        skill: true
+      update: {
+        publisherName: publisherName || "Anonymous",
+        updatedAt: /* @__PURE__ */ new Date()
       }
     });
     res.status(201).json({
       success: true,
-      data: marketplaceSkill,
+      data: { ok: true },
       message: "Skill published to marketplace successfully"
     });
   } catch (error) {
@@ -1820,66 +2142,117 @@ router3.post("/publish", async (req, res, next) => {
 });
 router3.post("/install/:id", async (req, res, next) => {
   try {
-    const marketplaceSkill = await prisma.marketplaceSkill.findUnique({
-      where: { id: req.params.id },
-      include: {
-        skill: true
+    const ghCfg = requireMarketplaceGitHubConfig();
+    const registry = new GitHubMarketplaceRegistry(ghCfg);
+    let index;
+    let sha;
+    try {
+      const result = await registry.readIndexFromRepo();
+      index = result.index;
+      sha = result.sha;
+    } catch (e) {
+      console.warn("Failed to read index from repo for install count:", e);
+      index = await fetchIndex();
+    }
+    const entryIndex = (index.skills || []).findIndex(
+      (s) => GitHubMarketplaceRegistry.stableIdForEntry(s) === req.params.id
+    );
+    const entry = entryIndex >= 0 ? index.skills[entryIndex] : void 0;
+    if (!entry) throw new AppError(ErrorCode.NOT_FOUND, "Marketplace skill not found", 404);
+    if (sha) {
+      try {
+        entry.downloads = (entry.downloads || 0) + 1;
+        index.skills[entryIndex] = entry;
+        await registry.upsertIndexToRepo(index, sha);
+      } catch (e) {
+        console.warn("Failed to update download count:", e);
       }
-    });
-    if (!marketplaceSkill) {
-      throw new AppError(ErrorCode.NOT_FOUND, "Marketplace skill not found", 404);
     }
-    const sourceSkill = marketplaceSkill.skill;
-    if (sourceSkill.source === "git" && sourceSkill.sourceUrl) {
-      const newSkill = await skillService.createSkillFromGit(
-        sourceSkill.sourceUrl,
-        sourceSkill.description || void 0
-      );
-      await prisma.marketplaceSkill.update({
-        where: { id: req.params.id },
-        data: { downloads: { increment: 1 } }
-      });
+    if (entry.type === "git") {
+      const newSkill = await skillService.createSkillFromGit(entry.gitUrl, entry.description || void 0);
       return res.status(201).json({
         success: true,
         data: newSkill,
         message: "Skill installed from marketplace successfully"
       });
     }
-    if (sourceSkill.source === "local" && marketplaceSkill.bundlePath && existsSync6(marketplaceSkill.bundlePath)) {
+    const tempDir = process.env.TEMP_DIR || join6(process.env.HOME || "", ".skillverse", "temp");
+    await mkdir5(tempDir, { recursive: true });
+    const resp = await fetch(entry.bundleUrl);
+    if (!resp.ok) {
+      throw new AppError(
+        ErrorCode.INTERNAL_ERROR,
+        `Failed to download bundle: ${resp.status} ${resp.statusText}`,
+        502
+      );
+    }
+    const buf = Buffer.from(await resp.arrayBuffer());
+    const tmpPath = join6(tempDir, `marketplace-${entry.name}-${Date.now()}.tar.gz`);
+    await writeFile(tmpPath, buf);
+    try {
       const newSkill = await skillService.createSkillFromBundle(
-        marketplaceSkill.bundlePath,
-        sourceSkill.name,
-        sourceSkill.description || void 0
+        tmpPath,
+        entry.name,
+        entry.description || void 0
       );
-      await prisma.marketplaceSkill.update({
-        where: { id: req.params.id },
-        data: { downloads: { increment: 1 } }
-      });
       return res.status(201).json({
         success: true,
         data: newSkill,
         message: "Skill installed from marketplace successfully"
       });
+    } finally {
+      await rm5(tmpPath, { force: true }).catch(() => {
+      });
     }
-    return res.status(400).json({
-      success: false,
-      error: "Cannot install this skill. Bundle not available."
-    });
   } catch (error) {
     next(error);
   }
 });
 router3.delete("/unpublish/:skillId", async (req, res, next) => {
   try {
-    const marketplaceSkill = await prisma.marketplaceSkill.findUnique({
-      where: { skillId: req.params.skillId }
+    const skill = await skillService.getSkillById(req.params.skillId);
+    const ghCfg = requireMarketplaceGitHubConfig();
+    if (!ghCfg.owner || !ghCfg.repo || !ghCfg.branch || !ghCfg.token) {
+      throw new AppError(
+        ErrorCode.VALIDATION_ERROR,
+        "GitHub registry config is incomplete. Please set owner/repo/branch/token in Settings -> Marketplace.",
+        400
+      );
+    }
+    const registry = new GitHubMarketplaceRegistry(ghCfg);
+    const { index, sha } = await registry.readIndexFromRepo();
+    const before = index.skills.length;
+    const entryToRemove = index.skills.find((s) => {
+      if (s?.name !== skill.name) return false;
+      if (skill.source === "git") return s.type === "git";
+      return s.type === "bundle";
     });
-    if (!marketplaceSkill) {
+    if (entryToRemove) {
+      if (entryToRemove.type === "bundle" && entryToRemove.bundleUrl) {
+        try {
+          const match = entryToRemove.bundleUrl.match(/\/releases\/download\/(.+)\/[^/]+$/);
+          if (match && match[1]) {
+            const tag = decodeURIComponent(match[1]);
+            console.log(`Deleting release tag: ${tag}`);
+            await registry.deleteReleaseByTag(tag);
+          }
+        } catch (e) {
+          console.warn("Failed to delete GitHub release:", e);
+        }
+      }
+      index.skills = index.skills.filter((s) => s !== entryToRemove);
+    }
+    const after = index.skills.length;
+    if (before === after) {
       throw new AppError(ErrorCode.NOT_FOUND, "Skill is not published to marketplace", 404);
     }
-    await prisma.marketplaceSkill.delete({
-      where: { id: marketplaceSkill.id }
-    });
+    await registry.upsertIndexToRepo(index, sha);
+    try {
+      await prisma.marketplaceSkill.delete({
+        where: { skillId: skill.id }
+      });
+    } catch (e) {
+    }
     res.json({
       success: true,
       message: "Skill unpublished from marketplace successfully"
@@ -1985,16 +2358,16 @@ var dashboard_default = router4;
 
 // src/routes/config.ts
 import { Router as Router5 } from "express";
-import { join as join6 } from "path";
-import { existsSync as existsSync7, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { join as join7 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync3, writeFileSync } from "fs";
 var router5 = Router5();
 var HOME = process.env.HOME || process.env.USERPROFILE || "";
-var BOOTSTRAP_HOME = join6(HOME, ".skillverse");
-var CONFIG_FILE = join6(BOOTSTRAP_HOME, "config.json");
+var BOOTSTRAP_HOME = join7(HOME, ".skillverse");
+var CONFIG_FILE = join7(BOOTSTRAP_HOME, "config.json");
 function readConfig() {
   if (existsSync7(CONFIG_FILE)) {
     try {
-      return JSON.parse(readFileSync2(CONFIG_FILE, "utf-8"));
+      return JSON.parse(readFileSync3(CONFIG_FILE, "utf-8"));
     } catch (e) {
       console.error("Failed to read config.json:", e);
       return {};
@@ -2009,8 +2382,17 @@ router5.get("/", (req, res, next) => {
       // Show saved preference if available, otherwise current env/default
       skillverseHome: fileConfig.skillverseHome || process.env.SKILLVERSE_HOME || BOOTSTRAP_HOME,
       // registryUrl is potentially in config.json already
-      registryUrl: fileConfig.registryUrl || process.env.SKILLVERSE_REGISTRY || "http://localhost:4000"
-      // ... add other configurable items
+      registryUrl: fileConfig.registryUrl || process.env.SKILLVERSE_REGISTRY || "http://localhost:4000",
+      // Marketplace is now hardcoded
+      marketplace: {
+        indexUrl: "",
+        github: {
+          owner: "",
+          repo: "",
+          branch: "",
+          tokenConfigured: false
+        }
+      }
     };
     res.json({
       success: true,
@@ -2022,19 +2404,19 @@ router5.get("/", (req, res, next) => {
 });
 router5.post("/", async (req, res, next) => {
   try {
-    const { skillverseHome, registryUrl, migrate } = req.body;
+    const { skillverseHome, registryUrl, migrate, marketplace } = req.body;
     const currentConfig = readConfig();
     const oldHome = process.env.SKILLVERSE_HOME || BOOTSTRAP_HOME;
     if (migrate && skillverseHome && skillverseHome !== oldHome) {
       console.log(`Migrating data from ${oldHome} to ${skillverseHome}...`);
       const { cp: cp2 } = await import("fs/promises");
       if (!existsSync7(skillverseHome)) {
-        const { mkdir: mkdir6 } = await import("fs/promises");
-        await mkdir6(skillverseHome, { recursive: true });
+        const { mkdir: mkdir7 } = await import("fs/promises");
+        await mkdir7(skillverseHome, { recursive: true });
       }
       const copyDir = async (srcName) => {
-        const src = join6(oldHome, srcName);
-        const dest = join6(skillverseHome, srcName);
+        const src = join7(oldHome, srcName);
+        const dest = join7(skillverseHome, srcName);
         if (existsSync7(src)) {
           console.log(`Copying ${srcName}...`);
           await cp2(src, dest, { recursive: true, force: true });
@@ -2042,8 +2424,8 @@ router5.post("/", async (req, res, next) => {
       };
       await copyDir("skills");
       await copyDir("marketplace");
-      const dbSrc = join6(oldHome, "skillverse.db");
-      const dbDest = join6(skillverseHome, "skillverse.db");
+      const dbSrc = join7(oldHome, "skillverse.db");
+      const dbDest = join7(skillverseHome, "skillverse.db");
       if (existsSync7(dbSrc)) {
         console.log("Copying database...");
         await cp2(dbSrc, dbDest, { force: true });
@@ -2053,8 +2435,8 @@ router5.post("/", async (req, res, next) => {
         if (existsSync7(shmSrc)) await cp2(shmSrc, dbDest + "-shm", { force: true });
         console.log("Updating skill paths in new database...");
         const { execSync } = await import("child_process");
-        const oldSkillsPath = join6(oldHome, "skills");
-        const newSkillsPath = join6(skillverseHome, "skills");
+        const oldSkillsPath = join7(oldHome, "skills");
+        const newSkillsPath = join7(skillverseHome, "skills");
         const updateQuery = `UPDATE Skill SET storagePath = replace(storagePath, '${oldSkillsPath}', '${newSkillsPath}') WHERE storagePath LIKE '${oldSkillsPath}%';`;
         try {
           execSync(`sqlite3 "${dbDest}" "${updateQuery}"`, { encoding: "utf-8" });
@@ -2064,21 +2446,79 @@ router5.post("/", async (req, res, next) => {
         }
       }
     }
-    const newConfig = {
+    const nextConfig = {
       ...currentConfig,
       ...skillverseHome && { skillverseHome },
       ...registryUrl && { registryUrl }
     };
-    writeFileSync(CONFIG_FILE, JSON.stringify(newConfig, null, 2));
+    writeFileSync(CONFIG_FILE, JSON.stringify(nextConfig, null, 2));
     res.json({
       success: true,
-      data: newConfig,
+      data: {
+        ...nextConfig,
+        // Never return token
+        marketplace: {
+          indexUrl: nextConfig.marketplace?.indexUrl || "",
+          github: {
+            owner: nextConfig.marketplace?.github?.owner || "",
+            repo: nextConfig.marketplace?.github?.repo || "",
+            branch: nextConfig.marketplace?.github?.branch || "main",
+            tokenConfigured: Boolean(nextConfig.marketplace?.github?.token)
+          }
+        }
+      },
       message: "Configuration saved. Restart server for changes to take effect."
     });
   } catch (error) {
     next(error);
   }
 });
+router5.get("/version", async (req, res, next) => {
+  try {
+    const { dirname: dirname4, join: pathJoin } = await import("path");
+    const { fileURLToPath: fileURLToPath4 } = await import("url");
+    const __filename4 = fileURLToPath4(import.meta.url);
+    const __dirname4 = dirname4(__filename4);
+    const packageJsonPath = pathJoin(__dirname4, "..", "..", "package.json");
+    let currentVersion = "0.0.0";
+    if (existsSync7(packageJsonPath)) {
+      const pkg = JSON.parse(readFileSync3(packageJsonPath, "utf-8"));
+      currentVersion = pkg.version || "0.0.0";
+    }
+    let latestVersion = currentVersion;
+    let hasUpdate = false;
+    try {
+      const response = await fetch("https://registry.npmjs.org/skillverse/latest");
+      if (response.ok) {
+        const data = await response.json();
+        latestVersion = data.version || currentVersion;
+        const parseVersion = (v) => v.split(".").map((n) => parseInt(n, 10) || 0);
+        const current = parseVersion(currentVersion);
+        const latest = parseVersion(latestVersion);
+        for (let i = 0; i < 3; i++) {
+          if (latest[i] > current[i]) {
+            hasUpdate = true;
+            break;
+          } else if (latest[i] < current[i]) {
+            break;
+          }
+        }
+      }
+    } catch (fetchError) {
+      console.warn("Failed to check npm registry for updates:", fetchError);
+    }
+    res.json({
+      success: true,
+      data: {
+        currentVersion,
+        latestVersion,
+        hasUpdate
+      }
+    });
+  } catch (error) {
+    next(error);
+  }
+});
 var config_default = router5;
 
 // src/index.ts
@@ -2097,7 +2537,7 @@ function requestLogger(req, res, next) {
 // src/lib/initDb.ts
 init_db();
 import { existsSync as existsSync8 } from "fs";
-import { join as join7, dirname as dirname2 } from "path";
+import { join as join8, dirname as dirname2 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { spawnSync } from "child_process";
 var __filename2 = fileURLToPath2(import.meta.url);
@@ -2105,13 +2545,13 @@ var __dirname2 = dirname2(__filename2);
 function getSchemaPath() {
   const possiblePaths = [
     // Prod: dist/bin.js -> dist/../prisma/schema.prisma (i.e. ROOT/prisma/schema.prisma)
-    join7(__dirname2, "../prisma/schema.prisma"),
+    join8(__dirname2, "../prisma/schema.prisma"),
     // Dev: src/lib/initDb.ts -> src/prisma/schema.prisma ? No, src/../prisma -> server/prisma
     // If __dirname is src/lib: ../../prisma/schema.prisma
-    join7(__dirname2, "../../prisma/schema.prisma"),
+    join8(__dirname2, "../../prisma/schema.prisma"),
     // Fallbacks
-    join7(process.cwd(), "prisma/schema.prisma"),
-    join7(process.cwd(), "server/prisma/schema.prisma")
+    join8(process.cwd(), "prisma/schema.prisma"),
+    join8(process.cwd(), "server/prisma/schema.prisma")
   ];
   return possiblePaths.find((p) => existsSync8(p)) || null;
 }
@@ -2138,10 +2578,10 @@ async function initializeDatabase() {
     throw new Error("Could not find schema.prisma");
   }
   const possiblePrismaBins = [
-    join7(__dirname2, "../node_modules/.bin/prisma"),
-    join7(__dirname2, "../../node_modules/.bin/prisma"),
-    join7(__dirname2, "../../../node_modules/.bin/prisma"),
-    join7(process.cwd(), "node_modules/.bin/prisma")
+    join8(__dirname2, "../node_modules/.bin/prisma"),
+    join8(__dirname2, "../../node_modules/.bin/prisma"),
+    join8(__dirname2, "../../../node_modules/.bin/prisma"),
+    join8(process.cwd(), "node_modules/.bin/prisma")
   ];
   const prismaBin = possiblePrismaBins.find((p) => existsSync8(p)) || "prisma";
   console.log(`   Using schema: ${schemaPath}`);
@@ -2170,13 +2610,13 @@ app.use(express.json());
 app.use(express.urlencoded({ extended: true }));
 app.use(requestLogger);
 var possiblePublicDirs = [
-  join8(__dirname3, "../public"),
+  join9(__dirname3, "../public"),
   // Production: dist/index.js -> public
-  join8(__dirname3, "../../public"),
+  join9(__dirname3, "../../public"),
   // Dev tsx might resolve here 
-  join8(process.cwd(), "public"),
+  join9(process.cwd(), "public"),
   // Fallback: relative to cwd
-  join8(process.cwd(), "server/public")
+  join9(process.cwd(), "server/public")
   // Fallback: from root
 ];
 var publicDir = possiblePublicDirs.find((dir) => existsSync9(dir));
@@ -2196,18 +2636,18 @@ app.get("/health", (req, res) => {
 });
 if (publicDir && existsSync9(publicDir)) {
   app.get("*", (req, res) => {
-    res.sendFile(join8(publicDir, "index.html"));
+    res.sendFile(join9(publicDir, "index.html"));
   });
 }
 app.use(errorHandler);
 async function initializeStorage() {
-  const skillverseHome = process.env.SKILLVERSE_HOME || join8(process.env.HOME || "", ".skillverse");
-  const skillsDir = process.env.SKILLS_DIR || join8(skillverseHome, "skills");
-  const marketplaceDir = process.env.MARKETPLACE_DIR || join8(skillverseHome, "marketplace");
+  const skillverseHome = process.env.SKILLVERSE_HOME || join9(process.env.HOME || "", ".skillverse");
+  const skillsDir = process.env.SKILLS_DIR || join9(skillverseHome, "skills");
+  const marketplaceDir = process.env.MARKETPLACE_DIR || join9(skillverseHome, "marketplace");
   const dirs = [skillverseHome, skillsDir, marketplaceDir];
   for (const dir of dirs) {
     if (!existsSync9(dir)) {
-      await mkdir5(dir, { recursive: true });
+      await mkdir6(dir, { recursive: true });
       console.log(`Created directory: ${dir}`);
     }
   }
@@ -2216,13 +2656,13 @@ async function startServer(port = 3001) {
   try {
     await initializeStorage();
     await ensureDatabaseInitialized();
-    console.log("\u{1F50D} Scanning for existing skills...");
+    console.log("\u{1F50D} Syncing skills with filesystem...");
     const { skillService: skillService2 } = await Promise.resolve().then(() => (init_skillService(), skillService_exports));
-    await skillService2.scanForSkills();
+    await skillService2.syncSkillsWithFileSystem();
     return new Promise((resolve) => {
       app.listen(port, () => {
         console.log(`\u{1F680} SkillVerse server running on http://localhost:${port}`);
-        console.log(`\u{1F4C1} Storage: ${process.env.SKILLVERSE_HOME || join8(process.env.HOME || "", ".skillverse")}`);
+        console.log(`\u{1F4C1} Storage: ${process.env.SKILLVERSE_HOME || join9(process.env.HOME || "", ".skillverse")}`);
         resolve();
       });
     });