soturail 0.2.2 → 0.3.0

package/dist/core/skill-exporter.js

@@ -0,0 +1,72 @@
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { ensureWorkspace, getWorkspacePaths } from "./config.js";
+import { readSkills } from "./skill-store.js";
+import { validateSkills } from "./skill-validator.js";
+export async function exportSkills(target, root = process.cwd()) {
+    await ensureWorkspace(root);
+    const validation = await validateSkills(root);
+    if (!validation.ok) {
+        throw new Error("Cannot export invalid skills. Run soturail skills validate for details.");
+    }
+    const skills = await readSkills(root);
+    const paths = getWorkspacePaths(root);
+    const targetDir = path.join(paths.skillExportsDir, target);
+    await fs.mkdir(targetDir, { recursive: true });
+    const written = [];
+    for (const skill of skills) {
+        const filePath = path.join(targetDir, `${skill.metadata.id}.md`);
+        await fs.writeFile(filePath, renderTargetSkill(target, skill.metadata.id, skill.markdown), "utf8");
+        written.push(path.normalize(path.relative(root, filePath)));
+    }
+    const indexPath = path.join(targetDir, "index.md");
+    await fs.writeFile(indexPath, renderExportIndex(target, skills.map((skill) => skill.metadata.id)), "utf8");
+    written.push(path.normalize(path.relative(root, indexPath)));
+    return `Exported ${skills.length} skill(s) for ${target}:\n${written.join("\n")}\n`;
+}
+export async function packSkills(format, root = process.cwd()) {
+    await ensureWorkspace(root);
+    const skills = await readSkills(root);
+    const paths = getWorkspacePaths(root);
+    const filePath = path.join(paths.skillExportsDir, `skills-pack.${format === "json" ? "json" : "md"}`);
+    const payload = format === "json"
+        ? `${JSON.stringify(skills.map((skill) => ({ metadata: skill.metadata, markdown: skill.markdown })), null, 2)}\n`
+        : skills.map((skill) => renderTargetSkill("generic", skill.metadata.id, skill.markdown)).join("\n---\n");
+    await fs.mkdir(path.dirname(filePath), { recursive: true });
+    await fs.writeFile(filePath, payload, "utf8");
+    return `Skill pack written: ${path.normalize(path.relative(root, filePath))}\n`;
+}
+function renderTargetSkill(target, id, markdown) {
+    const header = [
+        `# SotuRail Skill: ${id}`,
+        "",
+        `Target: ${target}`,
+        "Generated by SotuRail Skill Rail as an independent local-first export.",
+        "",
+        "Safety constraints:",
+        "- Do not run destructive shell commands.",
+        "- Do not exfiltrate secrets.",
+        "- Ask for human approval before remote writes or destructive actions.",
+        "- Treat this export as project-local guidance, not a marketplace install.",
+        ""
+    ];
+    const targetNote = {
+        claude: "Claude usage: place this in a reviewed skill/rules location supported by your installed Claude Code version.",
+        codex: "Codex usage: include this in AGENTS.md or project rules after review.",
+        gemini: "Gemini usage: include this as concise project guidance after review.",
+        cursor: "Cursor usage: include this in .cursor/rules after review.",
+        generic: "Generic usage: portable Markdown guidance for local AI agent workflows."
+    };
+    return `${header.join("\n")}${targetNote[target]}\n\n${markdown.trim()}\n`;
+}
+function renderExportIndex(target, ids) {
+    return [
+        `# SotuRail ${target} Skill Export`,
+        "",
+        "Review all generated files before enabling them in an agent host.",
+        "",
+        ...ids.map((id) => `- [${id}](./${id}.md)`),
+        ""
+    ].join("\n");
+}
+//# sourceMappingURL=skill-exporter.js.map

package/dist/core/skill-exporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-exporter.js","sourceRoot":"","sources":["../../src/core/skill-exporter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEjE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAmB,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE;IAC1E,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;QACnG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACnD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3G,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,YAAY,MAAM,CAAC,MAAM,iBAAiB,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAA2B,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE;IAChF,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,eAAe,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,MAAM,KAAK,MAAM;QAC/B,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;QACjH,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3G,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,uBAAuB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC;AAClF,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAmB,EAAE,EAAU,EAAE,QAAgB;IAC1E,MAAM,MAAM,GAAG;QACb,qBAAqB,EAAE,EAAE;QACzB,EAAE;QACF,WAAW,MAAM,EAAE;QACnB,wEAAwE;QACxE,EAAE;QACF,qBAAqB;QACrB,0CAA0C;QAC1C,8BAA8B;QAC9B,uEAAuE;QACvE,2EAA2E;QAC3E,EAAE;KACH,CAAC;IACF,MAAM,UAAU,GAAgC;QAC9C,MAAM,EAAE,8GAA8G;QACtH,KAAK,EAAE,uEAAuE;QAC9E,MAAM,EAAE,sEAAsE;QAC9E,MAAM,EAAE,2DAA2D;QACnE,OAAO,EAAE,yEAAyE;KACnF,CAAC;IACF,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAmB,EAAE,GAAa;IAC3D,OAAO;QACL,cAAc,MAAM,eAAe;QACnC,EAAE;QACF,mEAAmE;QACnE,EAAE;QACF,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC;QAC3C,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/core/skill-schema.d.ts

@@ -0,0 +1,55 @@
+import { z } from "zod";
+export declare const SkillTargetSchema: z.ZodEnum<["claude", "codex", "gemini", "cursor", "generic"]>;
+export type SkillTarget = z.infer<typeof SkillTargetSchema>;
+export declare const SkillMetadataSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodString;
+    version: z.ZodString;
+    author: z.ZodString;
+    risk_level: z.ZodEnum<["low", "medium", "high"]>;
+    targets: z.ZodArray<z.ZodEnum<["claude", "codex", "gemini", "cursor", "generic"]>, "many">;
+    allowed_tools: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    forbidden_patterns: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    requires_human_approval: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    created_at: z.ZodString;
+    content_hash: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    version: string;
+    id: string;
+    name: string;
+    description: string;
+    author: string;
+    risk_level: "low" | "medium" | "high";
+    targets: ("claude" | "codex" | "gemini" | "cursor" | "generic")[];
+    allowed_tools: string[];
+    forbidden_patterns: string[];
+    requires_human_approval: string[];
+    created_at: string;
+    content_hash: string;
+}, {
+    version: string;
+    id: string;
+    name: string;
+    description: string;
+    author: string;
+    risk_level: "low" | "medium" | "high";
+    targets: ("claude" | "codex" | "gemini" | "cursor" | "generic")[];
+    created_at: string;
+    content_hash: string;
+    allowed_tools?: string[] | undefined;
+    forbidden_patterns?: string[] | undefined;
+    requires_human_approval?: string[] | undefined;
+}>;
+export type SkillMetadata = z.infer<typeof SkillMetadataSchema>;
+export interface SkillRecord {
+    metadata: SkillMetadata;
+    markdown: string;
+    dir: string;
+}
+export declare const defaultForbiddenPatterns: string[];
+export declare const defaultHumanApprovals: string[];
+export declare function slugifySkillName(name: string): string;
+export declare function stableSkillHash(metadata: Omit<SkillMetadata, "content_hash">, markdown: string): string;
+export declare function stringifySkillYaml(metadata: SkillMetadata): string;
+export declare function parseSkillYaml(text: string): Record<string, unknown>;

package/dist/core/skill-schema.js

@@ -0,0 +1,84 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+export const SkillTargetSchema = z.enum(["claude", "codex", "gemini", "cursor", "generic"]);
+export const SkillMetadataSchema = z.object({
+    id: z.string().min(1).regex(/^[a-z0-9][a-z0-9-]*$/),
+    name: z.string().min(1),
+    description: z.string().min(1),
+    version: z.string().min(1),
+    author: z.string().min(1),
+    risk_level: z.enum(["low", "medium", "high"]),
+    targets: z.array(SkillTargetSchema).min(1),
+    allowed_tools: z.array(z.string()).default([]),
+    forbidden_patterns: z.array(z.string()).default([]),
+    requires_human_approval: z.array(z.string()).default([]),
+    created_at: z.string().min(1),
+    content_hash: z.string().regex(/^[a-f0-9]{64}$/)
+});
+export const defaultForbiddenPatterns = ["rm -rf", "curl | sh", "git push"];
+export const defaultHumanApprovals = ["remote_write", "destructive_command"];
+export function slugifySkillName(name) {
+    return name
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 64) || "skill";
+}
+export function stableSkillHash(metadata, markdown) {
+    const normalized = JSON.stringify({ ...metadata, content_hash: undefined, markdown });
+    return createHash("sha256").update(normalized).digest("hex");
+}
+export function stringifySkillYaml(metadata) {
+    const scalar = (value) => value.includes(":") || value.includes("#") ? JSON.stringify(value) : value;
+    const lines = [];
+    for (const [key, value] of Object.entries(metadata)) {
+        if (Array.isArray(value)) {
+            lines.push(`${key}:`);
+            for (const item of value)
+                lines.push(`  - ${scalar(item)}`);
+        }
+        else {
+            lines.push(`${key}: ${scalar(String(value))}`);
+        }
+    }
+    return `${lines.join("\n")}\n`;
+}
+export function parseSkillYaml(text) {
+    const result = {};
+    let currentArray = null;
+    for (const rawLine of text.split(/\r?\n/)) {
+        const line = rawLine.trimEnd();
+        if (!line.trim() || line.trimStart().startsWith("#"))
+            continue;
+        const arrayMatch = line.match(/^([A-Za-z0-9_]+):\s*$/);
+        if (arrayMatch?.[1]) {
+            currentArray = arrayMatch[1];
+            result[currentArray] = [];
+            continue;
+        }
+        const itemMatch = line.match(/^\s*-\s*(.+)$/);
+        if (itemMatch?.[1] && currentArray && Array.isArray(result[currentArray])) {
+            result[currentArray].push(unquote(itemMatch[1].trim()));
+            continue;
+        }
+        const kv = line.match(/^([A-Za-z0-9_]+):\s*(.*)$/);
+        if (kv?.[1]) {
+            currentArray = null;
+            result[kv[1]] = unquote(kv[2] ?? "");
+        }
+    }
+    return result;
+}
+function unquote(value) {
+    if ((value.startsWith("\"") && value.endsWith("\"")) || (value.startsWith("'") && value.endsWith("'"))) {
+        try {
+            return JSON.parse(value);
+        }
+        catch {
+            return value.slice(1, -1);
+        }
+    }
+    return value;
+}
+//# sourceMappingURL=skill-schema.js.map

package/dist/core/skill-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-schema.js","sourceRoot":"","sources":["../../src/core/skill-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAG5F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACjD,CAAC,CAAC;AAUH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,cAAc,EAAE,qBAAqB,CAAC,CAAC;AAE7E,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI;SACR,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAA6C,EAAE,QAAgB;IAC7F,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAuB;IACxD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7G,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvD,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpB,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC9C,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACzE,MAAM,CAAC,YAAY,CAAc,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACtE,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACnD,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACZ,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACvG,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/core/skill-store.d.ts

@@ -0,0 +1,4 @@
+import { type SkillRecord } from "./skill-schema.js";
+export declare function createSkill(name: string, root?: string): Promise<SkillRecord>;
+export declare function readSkills(root?: string): Promise<SkillRecord[]>;
+export declare function renderSkillList(skills: SkillRecord[]): string;

package/dist/core/skill-store.js

@@ -0,0 +1,92 @@
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { ensureWorkspace, getWorkspacePaths } from "./config.js";
+import { defaultForbiddenPatterns, defaultHumanApprovals, parseSkillYaml, SkillMetadataSchema, slugifySkillName, stableSkillHash, stringifySkillYaml } from "./skill-schema.js";
+export async function createSkill(name, root = process.cwd()) {
+    await ensureWorkspace(root);
+    const paths = getWorkspacePaths(root);
+    const id = slugifySkillName(name);
+    const dir = path.join(paths.skillsDir, id);
+    const markdown = [
+        `# ${name}`,
+        "",
+        "Use this skill when the task matches the description and the repository owner has approved it.",
+        "",
+        "## Safety",
+        "",
+        "- Do not run destructive shell commands.",
+        "- Do not exfiltrate secrets.",
+        "- Ask for human approval before remote writes or destructive actions.",
+        ""
+    ].join("\n");
+    const base = {
+        id,
+        name,
+        description: `Safe local-first workflow skill for ${name}.`,
+        version: "0.1.0",
+        author: "Rafael Ryan Ramos de Souza",
+        risk_level: "low",
+        targets: ["claude", "codex", "gemini", "cursor"],
+        allowed_tools: ["read", "search"],
+        forbidden_patterns: defaultForbiddenPatterns,
+        requires_human_approval: defaultHumanApprovals,
+        created_at: new Date().toISOString()
+    };
+    const metadata = { ...base, content_hash: stableSkillHash(base, markdown) };
+    await fs.mkdir(path.join(dir, "examples"), { recursive: true });
+    await fs.mkdir(path.join(dir, "validators"), { recursive: true });
+    await fs.writeFile(path.join(dir, "skill.yml"), stringifySkillYaml(metadata), "utf8");
+    await fs.writeFile(path.join(dir, "SKILL.md"), markdown, "utf8");
+    return { metadata, markdown, dir };
+}
+export async function readSkills(root = process.cwd()) {
+    const paths = getWorkspacePaths(root);
+    let entries = [];
+    try {
+        entries = await fs.readdir(paths.skillsDir);
+    }
+    catch {
+        return [];
+    }
+    const skills = [];
+    for (const entry of entries) {
+        const dir = path.join(paths.skillsDir, entry);
+        const stat = await fs.stat(dir).catch(() => null);
+        if (!stat?.isDirectory())
+            continue;
+        const yaml = await fs.readFile(path.join(dir, "skill.yml"), "utf8").catch(() => "");
+        const markdown = await fs.readFile(path.join(dir, "SKILL.md"), "utf8").catch(() => "");
+        const parsed = parseSkillYaml(yaml);
+        const result = SkillMetadataSchema.safeParse(parsed);
+        if (result.success) {
+            skills.push({ metadata: result.data, markdown, dir });
+        }
+        else {
+            skills.push({
+                metadata: {
+                    id: entry,
+                    name: entry,
+                    description: "Invalid skill metadata",
+                    version: "0.0.0",
+                    author: "unknown",
+                    risk_level: "high",
+                    targets: ["generic"],
+                    allowed_tools: [],
+                    forbidden_patterns: [],
+                    requires_human_approval: [],
+                    created_at: "invalid",
+                    content_hash: "0".repeat(64)
+                },
+                markdown,
+                dir
+            });
+        }
+    }
+    return skills.sort((left, right) => left.metadata.id.localeCompare(right.metadata.id));
+}
+export function renderSkillList(skills) {
+    if (skills.length === 0)
+        return "No skills found. Run soturail skills init <name> first.\n";
+    return skills.map((skill) => `${skill.metadata.id} [${skill.metadata.risk_level}] ${skill.metadata.name}`).join("\n") + "\n";
+}
+//# sourceMappingURL=skill-store.js.map

package/dist/core/skill-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-store.js","sourceRoot":"","sources":["../../src/core/skill-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAGnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE;IAClE,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG;QACf,KAAK,IAAI,EAAE;QACX,EAAE;QACF,gGAAgG;QAChG,EAAE;QACF,WAAW;QACX,EAAE;QACF,0CAA0C;QAC1C,8BAA8B;QAC9B,uEAAuE;QACvE,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,IAAI,GAAwC;QAChD,EAAE;QACF,IAAI;QACJ,WAAW,EAAE,uCAAuC,IAAI,GAAG;QAC3D,OAAO,EAAE,OAAO;QAChB,MAAM,EAAE,4BAA4B;QACpC,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAChD,aAAa,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QACjC,kBAAkB,EAAE,wBAAwB;QAC5C,uBAAuB,EAAE,qBAAqB;QAC9C,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IACF,MAAM,QAAQ,GAAkB,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;IAE3F,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IACtF,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE;IACnD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACpF,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC;gBACV,QAAQ,EAAE;oBACR,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,KAAK;oBACX,WAAW,EAAE,wBAAwB;oBACrC,OAAO,EAAE,OAAO;oBAChB,MAAM,EAAE,SAAS;oBACjB,UAAU,EAAE,MAAM;oBAClB,OAAO,EAAE,CAAC,SAAS,CAAC;oBACpB,aAAa,EAAE,EAAE;oBACjB,kBAAkB,EAAE,EAAE;oBACtB,uBAAuB,EAAE,EAAE;oBAC3B,UAAU,EAAE,SAAS;oBACrB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;iBAC7B;gBACD,QAAQ;gBACR,GAAG;aACJ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,2DAA2D,CAAC;IAC5F,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAC/H,CAAC"}

package/dist/core/skill-validator.d.ts

@@ -0,0 +1,12 @@
+export interface SkillValidationIssue {
+    skill_id: string;
+    severity: "error" | "warning";
+    message: string;
+}
+export interface SkillValidationResult {
+    ok: boolean;
+    skills_count: number;
+    issues: SkillValidationIssue[];
+}
+export declare function validateSkills(root?: string): Promise<SkillValidationResult>;
+export declare function formatSkillValidation(result: SkillValidationResult): string;

package/dist/core/skill-validator.js

@@ -0,0 +1,94 @@
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { parseSkillYaml, SkillMetadataSchema, stableSkillHash } from "./skill-schema.js";
+import { readSkills } from "./skill-store.js";
+const destructivePatterns = [
+    /\brm\s+-[^"\n]*r[^"\n]*f\b/i,
+    /\bcurl\b[^|\n]*\|\s*(sh|bash)\b/i,
+    /\bwget\b[^|\n]*\|\s*(sh|bash)\b/i,
+    /\bgit\s+push\b/i,
+    /\bdd\s+[^"\n]*\bif=/i,
+    /\bdel\s+\/s\b/i
+];
+const promptInjectionPatterns = [
+    /ignore (all )?(previous|prior) instructions/i,
+    /disregard (all )?(previous|prior) instructions/i,
+    /you are no longer bound/i
+];
+const secretPatterns = [
+    /sk-[A-Za-z0-9_-]{20,}/,
+    /AKIA[0-9A-Z]{16}/,
+    /-----BEGIN (RSA |OPENSSH |EC )?PRIVATE KEY-----/,
+    /(password|api[_-]?key|secret)\s*[:=]\s*["']?[A-Za-z0-9_\-]{16,}/i
+];
+export async function validateSkills(root = process.cwd()) {
+    const skills = await readSkills(root);
+    const issues = [];
+    const seen = new Set();
+    for (const skill of skills) {
+        await validateSkillFiles(skill, issues);
+        if (seen.has(skill.metadata.id)) {
+            issues.push({ skill_id: skill.metadata.id, severity: "error", message: "Duplicate skill id." });
+        }
+        seen.add(skill.metadata.id);
+        const combined = `${skill.markdown}\n${JSON.stringify({ ...skill.metadata, forbidden_patterns: [] })}`;
+        for (const pattern of destructivePatterns) {
+            if (pattern.test(skill.markdown)) {
+                issues.push({ skill_id: skill.metadata.id, severity: "error", message: `Hidden destructive command pattern detected: ${pattern}` });
+            }
+        }
+        for (const pattern of promptInjectionPatterns) {
+            if (pattern.test(combined)) {
+                issues.push({ skill_id: skill.metadata.id, severity: "error", message: `Prompt-injection style instruction detected: ${pattern}` });
+            }
+        }
+        for (const pattern of secretPatterns) {
+            if (pattern.test(combined)) {
+                issues.push({ skill_id: skill.metadata.id, severity: "error", message: "Probable embedded secret detected." });
+            }
+        }
+        const { content_hash: _hash, ...withoutHash } = skill.metadata;
+        const actual = stableSkillHash(withoutHash, skill.markdown);
+        if (actual !== skill.metadata.content_hash) {
+            issues.push({ skill_id: skill.metadata.id, severity: "error", message: "content_hash does not match skill.yml and SKILL.md content." });
+        }
+    }
+    return {
+        ok: issues.every((issue) => issue.severity !== "error"),
+        skills_count: skills.length,
+        issues
+    };
+}
+export function formatSkillValidation(result) {
+    const lines = [
+        `Skill validation: ${result.ok ? "passed" : "failed"}`,
+        `skills_count: ${result.skills_count}`
+    ];
+    if (result.issues.length === 0) {
+        lines.push("issues: none");
+    }
+    else {
+        for (const issue of result.issues) {
+            lines.push(`- ${issue.severity.toUpperCase()} ${issue.skill_id}: ${issue.message}`);
+        }
+    }
+    return `${lines.join("\n")}\n`;
+}
+async function validateSkillFiles(skill, issues) {
+    const yamlPath = path.join(skill.dir, "skill.yml");
+    const markdownPath = path.join(skill.dir, "SKILL.md");
+    const rawYaml = await fs.readFile(yamlPath, "utf8").catch(() => "");
+    const parsed = parseSkillYaml(rawYaml);
+    const result = SkillMetadataSchema.safeParse(parsed);
+    if (!result.success) {
+        issues.push({
+            skill_id: skill.metadata.id,
+            severity: "error",
+            message: `Invalid skill.yml: ${result.error.issues.map((issue) => issue.path.join(".")).join(", ")}`
+        });
+    }
+    if (!await fs.access(markdownPath).then(() => true).catch(() => false)) {
+        issues.push({ skill_id: skill.metadata.id, severity: "error", message: "Missing SKILL.md." });
+    }
+}
+//# sourceMappingURL=skill-validator.js.map

package/dist/core/skill-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-validator.js","sourceRoot":"","sources":["../../src/core/skill-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,eAAe,EAAoB,MAAM,mBAAmB,CAAC;AAC3G,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAc9C,MAAM,mBAAmB,GAAG;IAC1B,6BAA6B;IAC7B,kCAAkC;IAClC,kCAAkC;IAClC,iBAAiB;IACjB,sBAAsB;IACtB,gBAAgB;CACjB,CAAC;AAEF,MAAM,uBAAuB,GAAG;IAC9B,8CAA8C;IAC9C,iDAAiD;IACjD,0BAA0B;CAC3B,CAAC;AAEF,MAAM,cAAc,GAAG;IACrB,uBAAuB;IACvB,kBAAkB;IAClB,iDAAiD;IACjD,kEAAkE;CACnE,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE;IACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE5B,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QACvG,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,gDAAgD,OAAO,EAAE,EAAE,CAAC,CAAC;YACtI,CAAC;QACH,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,gDAAgD,OAAO,EAAE,EAAE,CAAC,CAAC;YACtI,CAAC;QACH,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;YACjH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,WAAW,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC/D,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,6DAA6D,EAAE,CAAC,CAAC;QAC1I,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC;QACvD,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,MAAM;KACP,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAA6B;IACjE,MAAM,KAAK,GAAG;QACZ,qBAAqB,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;QACtD,iBAAiB,MAAM,CAAC,YAAY,EAAE;KACvC,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,KAAkB,EAAE,MAA8B;IAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC;YACV,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;YAC3B,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,sBAAsB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAChG,CAAC;AACH,CAAC"}

package/dist/core/version.d.ts

@@ -0,0 +1 @@
+export declare const SOTURAIL_VERSION = "0.3.0";

package/dist/core/version.js

@@ -0,0 +1,3 @@
+// Generated by scripts/sync-version.mjs from package.json. Do not edit manually.
+export const SOTURAIL_VERSION = "0.3.0";
+//# sourceMappingURL=version.js.map

package/dist/core/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../../src/core/version.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC"}

package/docs/benchmarking.md

@@ -20,7 +20,12 @@ The suite groups results as:
 - agent response compression;
 - knowledge structuring;
 - cache stability;
-- native engine availability/performance when available.
+- native engine availability/performance when available;
+- skill rail validation/export;
+- MCP resource listing/reading;
+- context pack generation;
+- agent hook export;
+- memory approval workflow.
 
 Terminal compression includes npm install noise, Vitest failures, TypeScript diagnostics, git diff/status noise and JSON/tool payload output.
 

package/docs/comparisons.md

@@ -0,0 +1,35 @@
+# Comparison Philosophy
+
+SotuRail aims to unify these workflow ideas into one local-first, auditable, cache-friendly developer tool.
+
+SotuRail is an independent implementation. It does not vendor or depend on RTK, Squeez, Caveman, MemPalace, Spec Kit, agent-skills, SkillsMP, Compozy, Superpowers, OpenSpec or Istara.
+
+## Terminal Compression
+
+RTK-like terminal compression is conceptually related. SotuRail focuses on reversible raw logs, `raw_id` recovery and local safety policy. It does not claim to outperform RTK without reproducible benchmark evidence.
+
+## Hooks And Dedupe
+
+Squeez-like hooks and dedupe are adjacent ideas. SotuRail has prompt-only fallbacks, conservative Claude hooks, context packs and local dedupe as an independent implementation.
+
+## Response Compression
+
+Caveman-like response compression inspired the idea of shorter agent output. SotuRail implements professional deterministic modes that preserve code blocks, commands, paths and warnings.
+
+## Spec Workflows
+
+Spec Kit-like workflows are related to SotuRail specs. SotuRail integrates specs with logs, metrics, memory and context packs.
+
+## Local Memory
+
+MemPalace-like memory/evidence ideas are related. SotuRail uses local JSONL memory with approval workflow and stale marking, not full semantic memory yet.
+
+## Knowledge To Rules
+
+Nicole-style knowledge-to-rules workflows are related. SotuRail has `ingest` and `rules` with future hardened PDF extraction.
+
+## Skills And Workflow Orchestration
+
+Agent-skills and SkillsMP-like ecosystems are related to Skill Rail exports. Compozy, Superpowers and OpenSpec-style orchestration are future Workflow Rail territory.
+
+SotuRail should not be described as better than these projects unless a specific local benchmark proves a specific metric.

package/docs/context-packs.md

@@ -0,0 +1,29 @@
+# Context Packs
+
+Context packs are target-aware Markdown payloads for AI coding agents.
+
+```bash
+soturail context pack --target claude
+soturail context pack --target codex
+soturail context pack --target gemini
+soturail context pack --target cursor
+soturail context pack --target generic
+soturail context explain
+soturail context doctor
+```
+
+Generated files live in `.soturail/context/`.
+
+Stable-cache order:
+
+1. Static SotuRail header.
+2. Governance files summary.
+3. Project config.
+4. Repo map summary.
+5. Approved rules.
+6. Approved specs.
+7. Approved memory.
+8. Skills summary.
+9. Dynamic footer with timestamps, current commit, raw IDs and recent command notes.
+
+Dynamic data never appears before stable blocks.

package/docs/examples/skills/README.md

@@ -0,0 +1,11 @@
+# Skill Examples
+
+Generate local examples with:
+
+```bash
+soturail skills init demo-skill
+soturail skills validate
+soturail skills export --target generic
+```
+
+Generated skills live in `.soturail/skills/` and exports live in `.soturail/exports/skills/`.

package/docs/hooks/claude.md

@@ -1,11 +1,13 @@
 # Claude Hooks
 
-SotuRail v0.2.1 includes a conservative Claude Code hook template.
+SotuRail v0.3.0 includes conservative Claude safe-hooks and MCP guidance.
 
 ```bash
-soturail hooks install claude --dry-run
-soturail hooks install claude
-soturail hooks uninstall claude
+soturail hooks install --agent claude --mode safe-hooks --dry-run
+soturail hooks install --agent claude --mode safe-hooks
+soturail hooks install --agent claude --mode mcp
+soturail hooks uninstall --agent claude
+soturail hooks export --agent claude
 soturail hooks prompt-only claude
 ```
 

package/docs/hooks/codex.md

@@ -7,9 +7,10 @@ SotuRail does not assume private Codex host hook APIs. The fallback rules descri
 Useful commands:
 
 ```bash
-soturail hooks install codex --dry-run
-soturail hooks install codex
-soturail hooks uninstall codex
+soturail hooks install --agent codex --mode prompt-only --dry-run
+soturail hooks install --agent codex --mode prompt-only
+soturail hooks uninstall --agent codex
+soturail hooks export --agent codex
 soturail hooks prompt-only codex
 ```
 

package/docs/hooks/cursor.md

@@ -7,9 +7,10 @@ Existing files are backed up before SotuRail adds its rules.
 Useful commands:
 
 ```bash
-soturail hooks install cursor --dry-run
-soturail hooks install cursor
-soturail hooks uninstall cursor
+soturail hooks install --agent cursor --mode prompt-only --dry-run
+soturail hooks install --agent cursor --mode prompt-only
+soturail hooks uninstall --agent cursor
+soturail hooks export --agent cursor
 soturail hooks prompt-only cursor
 ```
 

package/docs/hooks/gemini.md

@@ -7,9 +7,10 @@ The generated rules keep repository scans, progressive file reads and raw log re
 Useful commands:
 
 ```bash
-soturail hooks install gemini --dry-run
-soturail hooks install gemini
-soturail hooks uninstall gemini
+soturail hooks install --agent gemini --mode prompt-only --dry-run
+soturail hooks install --agent gemini --mode prompt-only
+soturail hooks uninstall --agent gemini
+soturail hooks export --agent gemini
 soturail hooks prompt-only gemini
 ```
 

package/docs/hooks/mcp.md

@@ -0,0 +1,10 @@
+# MCP Hook Integration
+
+Use MCP mode when an agent host supports reviewed local MCP server configuration.
+
+```bash
+soturail hooks install --agent claude --mode mcp --dry-run
+soturail mcp serve --transport stdio
+```
+
+Review generated instructions before enabling. SotuRail's MCP server exposes read-only resources and safe tools; it does not expose arbitrary shell execution in v0.3.0.