skrypt-ai 0.4.2 → 0.6.0

package/dist/commands/llms-txt.js

@@ -1,6 +1,6 @@
 import { Command } from 'commander';
-import { existsSync, readFileSync, writeFileSync, readdirSync, statSync } from 'fs';
-import { resolve, join, extname } from 'path';
+import { existsSync, readFileSync, writeFileSync, readdirSync, statSync, mkdirSync } from 'fs';
+import { resolve, join, extname, dirname } from 'path';
 function extractFrontmatter(content) {
     const match = content.match(/^---\n([\s\S]*?)\n---/);
     if (!match)
@@ -136,54 +136,64 @@ export const llmsTxtCommand = new Command('llms-txt')
     .option('--title <title>', 'Documentation title', 'Documentation')
     .option('--description <desc>', 'Documentation description', 'API and usage documentation')
     .action(async (docsPath, options) => {
-    const resolvedDocs = resolve(docsPath);
-    const outputDir = resolve(options.output || './public');
-    console.log('skrypt llms-txt');
-    console.log(`  docs: ${resolvedDocs}`);
-    console.log(`  output: ${outputDir}`);
-    console.log(`  base-url: ${options.baseUrl}`);
-    console.log('');
-    // Check if docs directory exists
-    if (!existsSync(resolvedDocs)) {
-        console.error(`Error: Documentation directory not found: ${resolvedDocs}`);
-        process.exit(1);
+    try {
+        const resolvedDocs = resolve(docsPath);
+        const outputDir = resolve(options.output || './public');
+        console.log('skrypt llms-txt');
+        console.log(`  docs: ${resolvedDocs}`);
+        console.log(`  output: ${outputDir}`);
+        console.log(`  base-url: ${options.baseUrl}`);
+        console.log('');
+        // Check if docs directory exists
+        if (!existsSync(resolvedDocs)) {
+            console.error(`Error: Documentation directory not found: ${resolvedDocs}`);
+            process.exit(1);
+        }
+        // Scan documentation
+        console.log('Step 1: Scanning documentation...');
+        const docs = walkDocs(resolvedDocs);
+        if (docs.length === 0) {
+            console.error('Error: No documentation files found');
+            process.exit(1);
+        }
+        console.log(`  Found ${docs.length} documentation files`);
+        // Ensure output directory exists
+        mkdirSync(outputDir, { recursive: true });
+        // Generate llms.txt (summary)
+        console.log('\nStep 2: Generating llms.txt...');
+        const llmsTxt = generateLLMsTxt(docs, {
+            title: options.title || 'Documentation',
+            description: options.description || 'API and usage documentation',
+            baseUrl: options.baseUrl || 'https://docs.example.com'
+        });
+        const llmsTxtPath = join(outputDir, 'llms.txt');
+        mkdirSync(dirname(llmsTxtPath), { recursive: true });
+        writeFileSync(llmsTxtPath, llmsTxt);
+        console.log(`  Written: ${llmsTxtPath}`);
+        // Generate llms-full.txt (complete content)
+        console.log('\nStep 3: Generating llms-full.txt...');
+        const llmsFullTxt = generateLLMsFullTxt(docs, {
+            title: options.title || 'Documentation',
+            description: options.description || 'API and usage documentation',
+            baseUrl: options.baseUrl || 'https://docs.example.com'
+        });
+        const llmsFullTxtPath = join(outputDir, 'llms-full.txt');
+        mkdirSync(dirname(llmsFullTxtPath), { recursive: true });
+        writeFileSync(llmsFullTxtPath, llmsFullTxt);
+        console.log(`  Written: ${llmsFullTxtPath}`);
+        // Summary
+        console.log('\n=== Summary ===');
+        console.log(`  Documentation files: ${docs.length}`);
+        console.log(`  llms.txt: ${(llmsTxt.length / 1024).toFixed(1)} KB`);
+        console.log(`  llms-full.txt: ${(llmsFullTxt.length / 1024).toFixed(1)} KB`);
+        console.log('');
+        console.log('Add these to your robots.txt:');
+        console.log('  Sitemap: /llms.txt');
+        console.log('');
+        console.log('AI agents (GPTBot, ClaudeBot, etc.) will automatically discover your docs!');
     }
-    // Scan documentation
-    console.log('Step 1: Scanning documentation...');
-    const docs = walkDocs(resolvedDocs);
-    if (docs.length === 0) {
-        console.error('Error: No documentation files found');
+    catch (err) {
+        console.error(`Error: ${err instanceof Error ? err.message : err}`);
         process.exit(1);
     }
-    console.log(`  Found ${docs.length} documentation files`);
-    // Generate llms.txt (summary)
-    console.log('\nStep 2: Generating llms.txt...');
-    const llmsTxt = generateLLMsTxt(docs, {
-        title: options.title || 'Documentation',
-        description: options.description || 'API and usage documentation',
-        baseUrl: options.baseUrl || 'https://docs.example.com'
-    });
-    const llmsTxtPath = join(outputDir, 'llms.txt');
-    writeFileSync(llmsTxtPath, llmsTxt);
-    console.log(`  Written: ${llmsTxtPath}`);
-    // Generate llms-full.txt (complete content)
-    console.log('\nStep 3: Generating llms-full.txt...');
-    const llmsFullTxt = generateLLMsFullTxt(docs, {
-        title: options.title || 'Documentation',
-        description: options.description || 'API and usage documentation',
-        baseUrl: options.baseUrl || 'https://docs.example.com'
-    });
-    const llmsFullTxtPath = join(outputDir, 'llms-full.txt');
-    writeFileSync(llmsFullTxtPath, llmsFullTxt);
-    console.log(`  Written: ${llmsFullTxtPath}`);
-    // Summary
-    console.log('\n=== Summary ===');
-    console.log(`  Documentation files: ${docs.length}`);
-    console.log(`  llms.txt: ${(llmsTxt.length / 1024).toFixed(1)} KB`);
-    console.log(`  llms-full.txt: ${(llmsFullTxt.length / 1024).toFixed(1)} KB`);
-    console.log('');
-    console.log('Add these to your robots.txt:');
-    console.log('  Sitemap: /llms.txt');
-    console.log('');
-    console.log('AI agents (GPTBot, ClaudeBot, etc.) will automatically discover your docs!');
 });

package/dist/commands/login.js

@@ -1,5 +1,6 @@
 import { Command } from 'commander';
-import { saveAuthConfig, getAuthConfig, clearAuth, checkPlan } from '../auth/index.js';
+import { saveAuthConfig, getAuthConfigAsync, clearAuth, checkPlan, getKeyStorageMethod } from '../auth/index.js';
+import { getKeychainPlatformName } from '../auth/keychain.js';
 import * as readline from 'readline';
 function prompt(question) {
     const rl = readline.createInterface({
@@ -17,49 +18,77 @@ export const loginCommand = new Command('login')
     .description('Login to Skrypt Pro')
     .option('--key <api-key>', 'API key (or set SKRYPT_API_KEY env var)')
     .action(async (options) => {
-    console.log('skrypt login\n');
-    let apiKey = options.key || process.env.SKRYPT_API_KEY;
-    if (!apiKey) {
-        console.log('  Get your API key at: https://skrypt.sh/dashboard/settings\n');
-        apiKey = await prompt('  Enter API key: ');
-    }
-    if (!apiKey) {
-        console.error('  Error: No API key provided');
-        process.exit(1);
+    try {
+        console.log('skrypt login\n');
+        let apiKey = options.key || process.env.SKRYPT_API_KEY;
+        if (!apiKey) {
+            console.log('  Get your API key at: https://skrypt.sh/dashboard/settings\n');
+            apiKey = await prompt('  Enter API key: ');
+        }
+        if (!apiKey) {
+            console.error('  Error: No API key provided');
+            process.exit(1);
+        }
+        console.log('\n  Verifying...');
+        const result = await checkPlan(apiKey);
+        if (!result.valid) {
+            console.error(`\n  Error: ${result.error || 'Invalid API key'}`);
+            process.exit(1);
+        }
+        await saveAuthConfig({
+            apiKey,
+            email: result.email,
+            plan: result.plan,
+            expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString()
+        });
+        console.log(`\n  ✓ Logged in as ${result.email}`);
+        console.log(`  Plan: ${result.plan.toUpperCase()}\n`);
+        // Trust signals
+        const storageMethod = await getKeyStorageMethod();
+        if (storageMethod === 'keychain') {
+            console.log(`  🔒 API key stored in ${getKeychainPlatformName()}`);
+        }
+        else if (storageMethod === 'file') {
+            console.log('  🔒 API key stored in ~/.skrypt/auth.json (0600 permissions)');
+        }
+        console.log('  Your key is hashed (SHA-256) on our servers — never stored in plaintext');
+        console.log('');
+        if (result.plan === 'free') {
+            console.log('  Upgrade to Pro: https://skrypt.sh/pro\n');
+        }
     }
-    console.log('\n  Verifying...');
-    const result = await checkPlan(apiKey);
-    if (!result.valid) {
-        console.error(`\n  Error: ${result.error || 'Invalid API key'}`);
+    catch (err) {
+        console.error(`Error: ${err instanceof Error ? err.message : err}`);
         process.exit(1);
     }
-    saveAuthConfig({
-        apiKey,
-        email: result.email,
-        plan: result.plan,
-        expiresAt: new Date(Date.now() + 60 * 60 * 1000).toISOString()
-    });
-    console.log(`\n  ✓ Logged in as ${result.email}`);
-    console.log(`  Plan: ${result.plan.toUpperCase()}\n`);
-    if (result.plan === 'free') {
-        console.log('  Upgrade to Pro: https://skrypt.sh/pro\n');
-    }
 });
 export const logoutCommand = new Command('logout')
     .description('Logout from Skrypt')
     .action(async () => {
-    clearAuth();
-    console.log('  Logged out successfully\n');
+    try {
+        await clearAuth();
+        console.log('  Logged out successfully\n');
+    }
+    catch (err) {
+        console.error(`Error: ${err instanceof Error ? err.message : err}`);
+        process.exit(1);
+    }
 });
 export const whoamiCommand = new Command('whoami')
     .description('Show current login status')
     .action(async () => {
-    const config = getAuthConfig();
-    if (!config.apiKey) {
-        console.log('  Not logged in');
-        console.log('  Run: skrypt login\n');
-        return;
+    try {
+        const config = await getAuthConfigAsync();
+        if (!config.apiKey) {
+            console.log('  Not logged in');
+            console.log('  Run: skrypt login\n');
+            return;
+        }
+        console.log(`  Email: ${config.email || 'Unknown'}`);
+        console.log(`  Plan: ${(config.plan || 'free').toUpperCase()}\n`);
+    }
+    catch (err) {
+        console.error(`Error: ${err instanceof Error ? err.message : err}`);
+        process.exit(1);
     }
-    console.log(`  Email: ${config.email || 'Unknown'}`);
-    console.log(`  Plan: ${(config.plan || 'free').toUpperCase()}\n`);
 });

package/dist/commands/mcp.js

@@ -229,6 +229,12 @@ export const mcpCommand = new Command('mcp')
             // Get specific doc
             if (url.pathname.startsWith('/doc/')) {
                 const docPath = decodeURIComponent(url.pathname.slice(5));
+                // Prevent path traversal
+                if (docPath.includes('..') || docPath.startsWith('/')) {
+                    res.writeHead(400, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'Invalid path' }));
+                    return;
+                }
                 const doc = docs.find(d => d.path === docPath || d.path === docPath + '.mdx' || d.path === docPath + '.md');
                 if (doc) {
                     res.writeHead(200, { 'Content-Type': 'application/json' });

package/dist/commands/monitor.js

@@ -1,5 +1,5 @@
 import { Command } from 'commander';
-import { execSync, spawnSync } from 'child_process';
+import { spawnSync } from 'child_process';
 import { existsSync, writeFileSync, readdirSync, statSync, mkdirSync } from 'fs';
 import { resolve, join, dirname } from 'path';
 import { createLLMClient } from '../llm/index.js';
@@ -275,16 +275,21 @@ export const monitorCommand = new Command('monitor')
             console.log('\n=== Creating GitHub PR ===\n');
             try {
                 // Check if gh CLI is available
-                execSync('gh --version', { stdio: 'ignore' });
-                // Create branch
+                spawnSync('gh', ['--version'], { stdio: 'ignore' });
+                // Create branch (use spawnSync to avoid shell injection)
                 const branchName = `docs/auto-update-${Date.now()}`;
-                execSync(`git checkout -b ${branchName}`, { cwd: resolvedPath });
+                spawnSync('git', ['checkout', '-b', branchName], { cwd: resolvedPath, stdio: 'inherit' });
                 // Stage and commit
-                execSync('git add docs/', { cwd: resolvedPath });
-                execSync(`git commit -m "docs: auto-update documentation for recent changes"`, { cwd: resolvedPath });
+                spawnSync('git', ['add', 'docs/'], { cwd: resolvedPath, stdio: 'inherit' });
+                spawnSync('git', ['commit', '-m', 'docs: auto-update documentation for recent changes'], { cwd: resolvedPath, stdio: 'inherit' });
                 // Push and create PR
-                execSync(`git push -u origin ${branchName}`, { cwd: resolvedPath });
-                const prUrl = execSync(`gh pr create --title "docs: Auto-update documentation" --body "This PR was automatically generated by Skrypt monitor.\n\n## Changes\n${suggestions.map(s => `- ${s.action}: ${s.file}`).join('\n')}"`, { cwd: resolvedPath, encoding: 'utf-8' }).trim();
+                spawnSync('git', ['push', '-u', 'origin', branchName], { cwd: resolvedPath, stdio: 'inherit' });
+                const changesList = suggestions.map(s => `- ${s.action}: ${s.file}`).join('\n');
+                const prBody = `This PR was automatically generated by Skrypt monitor.\n\n## Changes\n${changesList}`;
+                const prResult = spawnSync('gh', ['pr', 'create', '--title', 'docs: Auto-update documentation', '--body', prBody], {
+                    cwd: resolvedPath, encoding: 'utf-8'
+                });
+                const prUrl = (prResult.stdout || '').trim();
                 console.log(`PR created: ${prUrl}`);
             }
             catch (err) {

package/dist/commands/qa.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare const qaCommand: Command;

package/dist/commands/qa.js

@@ -0,0 +1,43 @@
+import { Command } from 'commander';
+import { resolve } from 'path';
+import { existsSync } from 'fs';
+import { runQA, printQAReport, fixQAIssues, printFixReport } from '../qa/index.js';
+export const qaCommand = new Command('qa')
+    .description('Run quality assurance checks on documentation')
+    .argument('<dir>', 'Documentation directory to check')
+    .option('--strict', 'Fail on warnings (not just errors)')
+    .option('--fix', 'Auto-fix safe issues before reporting')
+    .action((dir, options) => {
+    const targetDir = resolve(dir);
+    if (!existsSync(targetDir)) {
+        console.error(`Error: Directory not found: ${targetDir}`);
+        process.exit(1);
+    }
+    console.log('skrypt qa');
+    console.log(`  target: ${targetDir}`);
+    // Auto-fix if requested
+    if (options.fix) {
+        const fixReport = fixQAIssues(targetDir);
+        printFixReport(fixReport);
+    }
+    const report = runQA(targetDir);
+    printQAReport(report);
+    // Show check-by-check summary
+    console.log('\n  Checks:');
+    for (const check of report.checks) {
+        const icon = check.passed ? '✓' : '✗';
+        const count = check.issues.length;
+        const label = count > 0 ? ` (${count} issue${count > 1 ? 's' : ''})` : '';
+        console.log(`    ${icon} ${check.check}${label}`);
+    }
+    console.log('');
+    if (!report.passed) {
+        console.log('QA failed — fix errors before deploying.\n');
+        process.exit(1);
+    }
+    if (options.strict && report.warnings > 0) {
+        console.log('QA failed (strict mode) — warnings present.\n');
+        process.exit(1);
+    }
+    console.log('QA passed.\n');
+});

package/dist/commands/review-pr.js

@@ -7,111 +7,127 @@ export const reviewPRCommand = new Command('review-pr')
     .option('--dry-run', 'Show issues without posting comments')
     .option('--token <token>', 'GitHub token (or use GITHUB_TOKEN env var)')
     .action(async (prUrl, options) => {
-    // Parse PR URL
-    const urlMatch = prUrl.match(/^https:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/);
-    if (!urlMatch) {
-        console.error('Error: Invalid PR URL format');
-        console.error('Expected: https://github.com/owner/repo/pull/123');
-        process.exit(1);
-    }
-    const owner = urlMatch[1];
-    const repo = urlMatch[2];
-    const pullNumber = urlMatch[3];
-    if (!owner || !repo || !pullNumber) {
-        console.error('Error: Could not parse owner/repo/PR number from URL');
-        process.exit(1);
-    }
-    console.log('skrypt review-pr');
-    console.log(`  repo:   ${owner}/${repo}`);
-    console.log(`  PR:     #${pullNumber}`);
-    console.log('');
-    const token = options.token || process.env.GITHUB_TOKEN;
-    if (!token) {
-        console.error('Error: GITHUB_TOKEN environment variable or --token required');
-        process.exit(1);
-    }
-    // Analyze the PR
-    console.log('Analyzing PR for documentation issues...');
-    const config = {
-        owner,
-        repo,
-        pullNumber: parseInt(pullNumber),
-        token,
-    };
-    let issues;
     try {
-        issues = await analyzePRForDocs(config);
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        console.error(`Error analyzing PR: ${message}`);
-        process.exit(1);
-    }
-    if (issues.length === 0) {
-        console.log('\n✓ No documentation issues found!');
-        process.exit(0);
-    }
-    console.log(`\nFound ${issues.length} issue(s):`);
-    console.log('');
-    // Group by severity
-    const errors = issues.filter(i => i.severity === 'error');
-    const warnings = issues.filter(i => i.severity === 'warning');
-    const infos = issues.filter(i => i.severity === 'info');
-    if (errors.length > 0) {
-        console.log(`❌ Errors (${errors.length}):`);
-        for (const issue of errors) {
-            console.log(`   ${issue.file}: ${issue.message}`);
+        // Parse PR URL
+        const urlMatch = prUrl.match(/^https:\/\/github\.com\/([^/]+)\/([^/]+)\/pull\/(\d+)/);
+        if (!urlMatch) {
+            console.error('Error: Invalid PR URL format');
+            console.error('Expected: https://github.com/owner/repo/pull/123');
+            process.exit(1);
         }
-    }
-    if (warnings.length > 0) {
-        console.log(`⚠️  Warnings (${warnings.length}):`);
-        for (const issue of warnings) {
-            console.log(`   ${issue.file}: ${issue.message}`);
+        const owner = urlMatch[1];
+        const repo = urlMatch[2];
+        const pullNumber = urlMatch[3];
+        if (!owner || !repo || !pullNumber) {
+            console.error('Error: Could not parse owner/repo/PR number from URL');
+            process.exit(1);
         }
-    }
-    if (infos.length > 0) {
-        console.log(`ℹ️  Suggestions (${infos.length}):`);
-        for (const issue of infos) {
-            console.log(`   ${issue.file}: ${issue.message}`);
+        // Validate owner/repo contain only safe characters (prevent API path injection)
+        const safeNamePattern = /^[a-zA-Z0-9._-]+$/;
+        if (!safeNamePattern.test(owner) || !safeNamePattern.test(repo)) {
+            console.error('Error: Invalid characters in owner/repo name');
+            process.exit(1);
         }
-    }
-    if (options.dryRun) {
-        console.log('\n[dry run - no comments posted]');
-        process.exit(0);
-    }
-    // Post comments
-    console.log('\nPosting comments to PR...');
-    if (options.inline) {
-        const inlineIssues = issues.filter(i => i.line);
-        const generalIssues = issues.filter(i => !i.line);
-        if (inlineIssues.length > 0) {
-            const inlineResults = await postInlineComments(config, inlineIssues);
-            const success = inlineResults.filter(r => r.success).length;
-            console.log(`  Posted ${success}/${inlineIssues.length} inline comments`);
+        console.log('skrypt review-pr');
+        console.log(`  repo:   ${owner}/${repo}`);
+        console.log(`  PR:     #${pullNumber}`);
+        console.log('');
+        if (options.token) {
+            console.warn('  Warning: Passing tokens via CLI arguments exposes them in shell history.');
+            console.warn('  Prefer: GITHUB_TOKEN env var\n');
         }
-        if (generalIssues.length > 0) {
-            const result = await postPRComment(config, generalIssues);
-            if (result.success) {
-                console.log(`  Posted summary comment`);
+        const token = options.token || process.env.GITHUB_TOKEN;
+        if (!token) {
+            console.error('Error: GITHUB_TOKEN environment variable or --token required');
+            process.exit(1);
+        }
+        // Analyze the PR
+        console.log('Analyzing PR for documentation issues...');
+        const config = {
+            owner,
+            repo,
+            pullNumber: parseInt(pullNumber),
+            token,
+        };
+        let issues;
+        try {
+            issues = await analyzePRForDocs(config);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`Error analyzing PR: ${message}`);
+            process.exit(1);
+        }
+        if (issues.length === 0) {
+            console.log('\n✓ No documentation issues found!');
+            process.exit(0);
+        }
+        console.log(`\nFound ${issues.length} issue(s):`);
+        console.log('');
+        // Group by severity
+        const errors = issues.filter(i => i.severity === 'error');
+        const warnings = issues.filter(i => i.severity === 'warning');
+        const infos = issues.filter(i => i.severity === 'info');
+        if (errors.length > 0) {
+            console.log(`❌ Errors (${errors.length}):`);
+            for (const issue of errors) {
+                console.log(`   ${issue.file}: ${issue.message}`);
             }
-            else {
-                console.error(`  Failed to post summary: ${result.error}`);
+        }
+        if (warnings.length > 0) {
+            console.log(`⚠️  Warnings (${warnings.length}):`);
+            for (const issue of warnings) {
+                console.log(`   ${issue.file}: ${issue.message}`);
             }
         }
-    }
-    else {
-        const result = await postPRComment(config, issues);
-        if (result.success) {
-            console.log(`✓ Comment posted successfully`);
+        if (infos.length > 0) {
+            console.log(`ℹ️  Suggestions (${infos.length}):`);
+            for (const issue of infos) {
+                console.log(`   ${issue.file}: ${issue.message}`);
+            }
+        }
+        if (options.dryRun) {
+            console.log('\n[dry run - no comments posted]');
+            process.exit(0);
+        }
+        // Post comments
+        console.log('\nPosting comments to PR...');
+        if (options.inline) {
+            const inlineIssues = issues.filter(i => i.line);
+            const generalIssues = issues.filter(i => !i.line);
+            if (inlineIssues.length > 0) {
+                const inlineResults = await postInlineComments(config, inlineIssues);
+                const success = inlineResults.filter(r => r.success).length;
+                console.log(`  Posted ${success}/${inlineIssues.length} inline comments`);
+            }
+            if (generalIssues.length > 0) {
+                const result = await postPRComment(config, generalIssues);
+                if (result.success) {
+                    console.log(`  Posted summary comment`);
+                }
+                else {
+                    console.error(`  Failed to post summary: ${result.error}`);
+                }
+            }
         }
         else {
-            console.error(`✗ Failed to post comment: ${result.error}`);
+            const result = await postPRComment(config, issues);
+            if (result.success) {
+                console.log(`✓ Comment posted successfully`);
+            }
+            else {
+                console.error(`✗ Failed to post comment: ${result.error}`);
+                process.exit(1);
+            }
+        }
+        console.log('\nDone!');
+        // Exit with error code if there are errors
+        if (errors.length > 0) {
             process.exit(1);
         }
     }
-    console.log('\nDone!');
-    // Exit with error code if there are errors
-    if (errors.length > 0) {
+    catch (err) {
+        console.error(`Error: ${err instanceof Error ? err.message : err}`);
         process.exit(1);
     }
 });