tokrepo 3.4.0 → 3.5.0

package/bin/tokrepo.js

@@ -25,7 +25,7 @@ const CONFIG_DIR = path.join(os.homedir(), '.tokrepo');
 const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
 const PROJECT_CONFIG = '.tokrepo.json';
 const DEFAULT_API = 'https://api.tokrepo.com';
-const CLI_VERSION = '3.4.0';
+const CLI_VERSION = '3.5.0';
 const VERSION_CHECK_FILE = path.join(os.homedir(), '.tokrepo', '.version-check');
 const CODEX_DIR = path.join(os.homedir(), '.codex');
 const CODEX_SKILLS_DIR = path.join(CODEX_DIR, 'skills');
@@ -236,6 +236,12 @@ function guessTag(fileType) {
   return map[fileType] || null;
 }
 
+function parseCsvList(value) {
+  if (!value) return [];
+  if (Array.isArray(value)) return value.flatMap(parseCsvList);
+  return String(value).split(',').map(s => s.trim()).filter(Boolean);
+}
+
 // ─── Glob matching ───
 
 function matchGlob(pattern, filename) {
@@ -295,7 +301,9 @@ function parseArgs(argv) {
   }
 
   const valueFlags = new Set([
-    'title', 'desc', 'tag', 'target', 'keyword', 'types',
+    'title', 'desc', 'tag', 'target', 'targets', 'keyword', 'types',
+    'kind', 'install-mode', 'install_mode', 'entrypoint', 'asset-kind', 'asset_kind',
+    'version',
     'page', 'page-size', 'page_size', 'sort-by', 'sort_by',
     'time-window', 'time_window',
   ]);
@@ -318,6 +326,10 @@ function parseArgs(argv) {
       args.flags.dryRun = value;
     } else if (normalized === 'approve_mcp') {
       args.flags.approveMcp = value;
+    } else if (normalized === 'install_mode') {
+      args.flags.installMode = value;
+    } else if (normalized === 'asset_kind') {
+      args.flags.assetKind = value;
     }
     args.flags[normalized] = value;
   };
@@ -574,6 +586,10 @@ async function cmdPush() {
   description = args.flags.desc || description || '';
   visibility = args.flags.public ? 1 : (args.flags.private ? 0 : (projectConfig?.visibility ?? 0));
   tags = args.flags.tags || tags || [];
+  const kind = args.flags.kind || args.flags.assetKind || projectConfig?.kind || projectConfig?.asset_kind || '';
+  const targetTools = parseCsvList(args.flags.targets || args.flags.target || projectConfig?.target_tools || projectConfig?.targetTools);
+  const installMode = args.flags.installMode || projectConfig?.install_mode || projectConfig?.installMode || '';
+  const entrypoint = args.flags.entrypoint || projectConfig?.entrypoint || '';
 
   // Read files and detect types
   const pushFiles = [];
@@ -613,6 +629,15 @@ async function cmdPush() {
   if (detectedTags.size > 0) {
     log(`  ${C.bold}Tags:${C.reset}       ${Array.from(detectedTags).join(', ')}`);
   }
+  const metadataSummary = [
+    kind ? `kind=${kind}` : '',
+    targetTools.length ? `target_tools=${targetTools.join(',')}` : '',
+    installMode ? `install_mode=${installMode}` : '',
+    entrypoint ? `entrypoint=${entrypoint}` : '',
+  ].filter(Boolean);
+  if (metadataSummary.length > 0) {
+    log(`  ${C.bold}Agent meta:${C.reset} ${metadataSummary.join(' · ')}`);
+  }
   log('');
 
   for (const f of pushFiles) {
@@ -634,6 +659,10 @@ async function cmdPush() {
       tags: Array.from(detectedTags),
       token_cost: String(Math.round(totalChars / 4)),
       visibility: visibility,
+      kind,
+      target_tools: targetTools,
+      install_mode: installMode,
+      entrypoint,
     }, config.token, config.api);
 
     log('');
@@ -1095,11 +1124,13 @@ function explicitInstallMode(workflow) {
   const candidates = [
     workflow?.installMode,
     workflow?.install_mode,
+    workflow?.agent_metadata?.install_mode,
+    workflow?.agentMetadata?.installMode,
     workflow?.metadata?.installMode,
     workflow?.metadata?.install_mode,
   ].filter(Boolean);
   const mode = String(candidates[0] || '').toLowerCase();
-  return ['single', 'bundle', 'split'].includes(mode) ? mode : '';
+  return ['single', 'bundle', 'split', 'stage_only'].includes(mode) ? mode : '';
 }
 
 function inferCodexInstallMode(workflow, contents) {
@@ -1157,6 +1188,7 @@ function addPlanFile(plan, destPath, content, sourceName, type) {
 
 function buildCodexInstallPlan(workflow, contents, opts = {}) {
   const installMode = opts.installMode || inferCodexInstallMode(workflow, contents);
+  const agentMetadata = workflow?.agent_metadata || workflow?.agentMetadata || {};
   const plan = {
     uuid: workflow.uuid,
     title: workflow.title,
@@ -1166,8 +1198,20 @@ function buildCodexInstallPlan(workflow, contents, opts = {}) {
     manifestPath: CODEX_MANIFEST_FILE,
     files: [],
     risks: [],
+    agentMetadata,
+    contentHash: workflow.content_hash || workflow.contentHash || agentMetadata.content_hash || '',
   };
 
+  if (installMode === 'stage_only') {
+    const stageDir = path.join(CODEX_TOKREPO_DIR, 'staged', workflow.uuid);
+    plan.baseDir = stageDir;
+    contents.forEach((item, index) => {
+      const relName = sanitizeRelativePath(item.name || `file-${index + 1}.md`);
+      addPlanFile(plan, path.join(stageDir, relName), `${String(item.content || '').trim()}\n`, item.name, item.type);
+    });
+    return plan;
+  }
+
   if (installMode === 'split') {
     const usedDirs = new Set();
     contents.forEach((item, index) => {
@@ -1244,6 +1288,9 @@ function publicInstallPlan(plan) {
     manifestPath: plan.manifestPath,
     baseDir: plan.baseDir,
     risks: plan.risks,
+    requiresConfirmation: hasCodexInstallRisks(plan),
+    contentHash: plan.contentHash || '',
+    agentMetadata: plan.agentMetadata || {},
     files: plan.files.map(file => ({
       path: file.path,
       sourceName: file.sourceName,
@@ -1265,6 +1312,7 @@ function formatRiskLine(file) {
 }
 
 async function confirmCodexInstallRisks(plan, opts = {}) {
+  if (plan.installMode === 'stage_only') return;
   if (opts.dryRun || opts.stage || !hasCodexInstallRisks(plan)) return;
   if (opts.approveMcp || opts.approve_mcp || opts.yes) return;
 
@@ -1301,6 +1349,32 @@ function stageCodexInstallPlan(plan) {
   return stagePath;
 }
 
+function executeStageOnlyCodexPlan(plan) {
+  const installedFiles = [];
+  const stageRoot = path.join(CODEX_TOKREPO_DIR, 'staged', plan.uuid);
+  if (!fs.existsSync(stageRoot)) fs.mkdirSync(stageRoot, { recursive: true, mode: 0o700 });
+
+  for (const file of plan.files) {
+    if (!ensureInside(stageRoot, file.path)) {
+      throw new Error(`Stage path escaped TokRepo staging directory: ${file.path}`);
+    }
+    const destDir = path.dirname(file.path);
+    if (!fs.existsSync(destDir)) fs.mkdirSync(destDir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(file.path, file.content, { mode: 0o600 });
+    installedFiles.push({
+      path: file.path,
+      sourceName: file.sourceName,
+      sha256: sha256(file.content),
+      bytes: Buffer.byteLength(String(file.content || '')),
+      riskFlags: file.riskFlags,
+    });
+  }
+
+  const stagePath = path.join(stageRoot, 'install-plan.json');
+  fs.writeFileSync(stagePath, `${JSON.stringify(publicInstallPlan(plan), null, 2)}\n`, { mode: 0o600 });
+  return { dryRun: true, staged: true, stageOnly: true, stagePath, plan: publicInstallPlan(plan), installedFiles };
+}
+
 function readCodexManifest() {
   try {
     const parsed = JSON.parse(fs.readFileSync(CODEX_MANIFEST_FILE, 'utf8'));
@@ -1322,6 +1396,8 @@ function writeCodexManifestRecord(plan, installedFiles) {
     targetTool: 'codex',
     installMode: plan.installMode,
     installedAt,
+    contentHash: plan.contentHash || '',
+    agentMetadata: plan.agentMetadata || {},
     installedFiles: installedFiles.map(file => ({
       path: file.path,
       sourceName: file.sourceName,
@@ -1340,6 +1416,7 @@ function writeCodexManifestRecord(plan, installedFiles) {
 
 function executeCodexInstallPlan(plan, opts = {}) {
   if (opts.dryRun) return { dryRun: true, plan: publicInstallPlan(plan), installedFiles: [] };
+  if (plan.installMode === 'stage_only') return executeStageOnlyCodexPlan(plan);
   if (opts.stage) {
     const stagePath = stageCodexInstallPlan(plan);
     return { dryRun: true, staged: true, stagePath, plan: publicInstallPlan(plan), installedFiles: [] };
@@ -1547,9 +1624,13 @@ async function installOneAsset(target, config, apiBase, opts) {
 
     if (!opts.json) {
       const plan = result.plan;
-      if (opts.stage) {
+      if (result.staged || opts.stage) {
         info(`Staged install plan: ${result.stagePath}`);
-        info(`No Codex skill files were written. Re-run with --approve-mcp or --yes to install.`);
+        if (result.stageOnly) {
+          info(`stage_only asset: files were written only under ${path.dirname(result.stagePath)}; no Codex skill was activated.`);
+        } else {
+          info(`No Codex skill files were written. Re-run with --approve-mcp or --yes to install.`);
+        }
       } else if (opts.dryRun) {
         info(`Dry run: ${plan.files.length} file(s) would be installed to ${CODEX_SKILLS_DIR}`);
         for (const file of plan.files) {
@@ -1764,6 +1845,12 @@ async function cmdList() {
 }
 
 async function cmdUpdate() {
+  const args = parseArgs(process.argv);
+  if (args.flags.target || args.flags.all || args.flags.force) {
+    await cmdSyncInstalled();
+    return;
+  }
+
   const uuid = process.argv[3];
   if (!uuid) error('Usage: tokrepo update <uuid> [file]');
 
@@ -1833,9 +1920,11 @@ function tagMatchesTypes(workflow, requestedTypes) {
   if (!requestedTypes || requestedTypes.length === 0) return true;
   const tags = (workflow.tags || []).flatMap(t => [t.slug, t.name]).filter(Boolean).map(t => String(t).toLowerCase());
   const assetType = getWorkflowAssetType(workflow);
+  const metadataKind = String(workflow.asset_kind || workflow.agent_metadata?.asset_kind || workflow.agentMetadata?.assetKind || '').toLowerCase();
   return requestedTypes.some(type => {
     const needle = String(type).trim().toLowerCase();
     if (!needle) return false;
+    if (metadataKind === needle || metadataKind === `${needle}s`) return true;
     if (assetType === needle || assetType === `${needle}s`) return true;
     return tags.some(tag => tag === needle || tag === `${needle}s` || tag.includes(needle));
   });
@@ -2116,17 +2205,17 @@ async function cmdSyncInstalled() {
 
   const manifest = readCodexManifest();
   const installed = (manifest.installs || []).filter(item => (item.targetTool || item.target_tool) === 'codex');
+  const dryRun = Boolean(args.flags.dryRun || args.flags.dry_run);
+  const stage = Boolean(args.flags.stage);
   if (installed.length === 0) {
-    if (json) outputJson({ targetTool: 'codex', count: 0, results: [] });
+    if (json) outputJson({ targetTool: 'codex', manifestPath: CODEX_MANIFEST_FILE, dryRun, stage, count: 0, results: [] });
     else info(`No Codex installs found in ${CODEX_MANIFEST_FILE}`);
     return;
   }
 
   const config = readConfig();
   const apiBase = config?.api || DEFAULT_API;
-  const dryRun = Boolean(args.flags.dryRun || args.flags.dry_run);
-  const stage = Boolean(args.flags.stage);
-  const force = Boolean(args.flags.update || args.flags.force);
+  const force = Boolean(args.flags.update || args.flags.force || args.flags.all);
   const results = [];
 
   for (let i = 0; i < installed.length; i++) {
@@ -2218,6 +2307,126 @@ async function cmdSyncInstalled() {
   }
 }
 
+async function cmdInstalled() {
+  const args = parseArgs(process.argv);
+  const targetTool = validateInstallTarget(args.flags.target || 'codex');
+  if (targetTool !== 'codex') error(`installed currently supports --target codex only`);
+
+  const json = Boolean(args.flags.json);
+  if (!json) log(`\n${C.bold}tokrepo installed${C.reset}\n`);
+
+  const manifest = readCodexManifest();
+  const records = (manifest.installs || []).filter(item => (item.targetTool || item.target_tool) === 'codex');
+  const list = records.map(record => {
+    const files = (record.installedFiles || record.installed_files || []).map(file => {
+      const actualSha = file.path && fs.existsSync(file.path) ? currentFileSha(file.path) : '';
+      return {
+        path: file.path,
+        sourceName: file.sourceName || file.source_name,
+        sha256: file.sha256,
+        exists: Boolean(file.path && fs.existsSync(file.path)),
+        changed: Boolean(actualSha && file.sha256 && actualSha !== file.sha256),
+      };
+    });
+    return {
+      uuid: record.uuid,
+      title: record.title,
+      sourceUrl: record.sourceUrl || record.source_url,
+      targetTool: 'codex',
+      installMode: record.installMode || record.install_mode,
+      installedAt: record.installedAt || record.installed_at,
+      contentHash: record.contentHash || record.content_hash || '',
+      risks: record.risks || [],
+      files,
+      status: files.some(file => !file.exists) ? 'missing-files' : files.some(file => file.changed) ? 'local-changes' : 'installed',
+    };
+  });
+
+  if (json) {
+    outputJson({ targetTool: 'codex', manifestPath: CODEX_MANIFEST_FILE, count: list.length, list });
+    return;
+  }
+
+  if (list.length === 0) {
+    info(`No Codex installs found in ${CODEX_MANIFEST_FILE}`);
+    return;
+  }
+
+  for (const item of list) {
+    const color = item.status === 'installed' ? C.green : C.yellow;
+    log(`  ${color}${item.status}${C.reset}  ${C.bold}${item.title || item.uuid}${C.reset}`);
+    log(`  ${C.dim}${item.uuid} · ${item.installMode || 'unknown'} · ${item.files.length} file(s)${C.reset}\n`);
+  }
+}
+
+async function cmdOutdated() {
+  const args = parseArgs(process.argv);
+  const targetTool = validateInstallTarget(args.flags.target || 'codex');
+  if (targetTool !== 'codex') error(`outdated currently supports --target codex only`);
+
+  const json = Boolean(args.flags.json);
+  if (!json) log(`\n${C.bold}tokrepo outdated${C.reset}\n`);
+
+  const manifest = readCodexManifest();
+  const installed = (manifest.installs || []).filter(item => (item.targetTool || item.target_tool) === 'codex');
+  if (installed.length === 0) {
+    if (json) outputJson({ targetTool: 'codex', count: 0, outdated: 0, list: [] });
+    else info(`No Codex installs found in ${CODEX_MANIFEST_FILE}`);
+    return;
+  }
+
+  const config = readConfig();
+  const apiBase = config?.api || DEFAULT_API;
+  const list = [];
+  let unchanged = 0;
+  let failed = 0;
+
+  for (const record of installed) {
+    try {
+      const { workflow, contents } = await fetchWorkflowForInstall(record.uuid, config, apiBase);
+      const plan = buildCodexInstallPlan(workflow, contents, { installMode: record.installMode || record.install_mode });
+      const diff = diffCodexPlanWithLocal(plan, record);
+      if (diff.needsUpdate) {
+        list.push({
+          uuid: record.uuid,
+          title: workflow.title,
+          status: 'outdated',
+          reasons: diff.reasons,
+          plan: publicInstallPlan(plan),
+        });
+      } else {
+        unchanged++;
+      }
+    } catch (e) {
+      failed++;
+      list.push({ uuid: record.uuid, title: record.title || record.uuid, status: 'failed', error: e.message });
+    }
+  }
+
+  if (json) {
+    outputJson({ targetTool: 'codex', manifestPath: CODEX_MANIFEST_FILE, count: installed.length, outdated: list.filter(i => i.status === 'outdated').length, unchanged, failed, list });
+    return;
+  }
+
+  const outdated = list.filter(item => item.status === 'outdated');
+  if (outdated.length === 0 && failed === 0) {
+    success(`All ${unchanged} Codex install(s) are up to date.`);
+    return;
+  }
+  for (const item of list) {
+    if (item.status === 'failed') {
+      warn(`${item.title}: ${item.error}`);
+    } else {
+      log(`  ${C.yellow}outdated${C.reset}  ${C.bold}${item.title}${C.reset}`);
+      for (const reason of item.reasons.slice(0, 3)) {
+        log(`    ${C.dim}${reason.type}: ${reason.path || ''}${C.reset}`);
+      }
+    }
+  }
+  log('');
+  info(`Run ${C.cyan}tokrepo update --target codex --all${C.reset} to update installed Codex assets.`);
+}
+
 async function cmdTags() {
   log(`\n${C.bold}tokrepo tags${C.reset}\n`);
 
@@ -2340,13 +2549,16 @@ ${C.bold}DISCOVER & INSTALL${C.reset}
   ${C.cyan}install${C.reset} <name|uuid> Smart install (auto-detects type & placement)
   ${C.cyan}pull${C.reset} <url|uuid|@u/n> Download raw asset files
   ${C.cyan}clone${C.reset} @username      Clone all assets from a user
+  ${C.cyan}installed${C.reset}            List installed Codex assets from manifest
+  ${C.cyan}outdated${C.reset}             Check installed Codex assets for updates
   ${C.cyan}sync-installed${C.reset}       Update installed Codex assets from manifest
 
 ${C.bold}PUBLISH${C.reset}
   ${C.cyan}push${C.reset} [files...]     Push files/directory (idempotent upsert)
   ${C.cyan}status${C.reset}              Compare local vs remote (like git status)
   ${C.cyan}init${C.reset}                Create .tokrepo.json project config
-  ${C.cyan}update${C.reset} <uuid> [f]   Update existing asset
+  ${C.cyan}update${C.reset} <uuid> [f]   Update existing remote asset
+  ${C.cyan}update${C.reset} --target codex --all   Update installed Codex assets
   ${C.cyan}delete${C.reset} <uuid>       Delete an asset
 
 ${C.bold}ACCOUNT${C.reset}
@@ -2362,6 +2574,9 @@ ${C.bold}PUSH OPTIONS${C.reset}
   ${C.cyan}--title${C.reset} "..."       Set title (auto-detected from README or dir name)
   ${C.cyan}--desc${C.reset} "..."        Set description
   ${C.cyan}--tag${C.reset} Skills        Add tag (repeatable)
+  ${C.cyan}--kind${C.reset} skill         Set agent asset_kind
+  ${C.cyan}--target${C.reset} codex       Add target tool metadata on push
+  ${C.cyan}--install-mode${C.reset} bundle Set install_mode metadata
 
 ${C.bold}INSTALL BEHAVIOR${C.reset}
   Skills   → .claude/skills/    (if .claude/ exists)
@@ -2380,8 +2595,12 @@ ${C.bold}EXAMPLES${C.reset}
   tokrepo install ca000374-f5d8-... --target codex
   tokrepo install c4b18aeb --target gemini    # Install for Gemini CLI
   tokrepo clone @henuwangkai --target codex --keyword video
+  tokrepo installed --target codex --json
+  tokrepo outdated --target codex --json
+  tokrepo update --target codex --all
   tokrepo sync-installed --target codex --dry-run
   tokrepo push --private my-rules.md          # Save one file privately
+  tokrepo push . --kind skill --target codex --install-mode bundle
   tokrepo push --public skill.md              # Share one file publicly
   tokrepo push --private .                    # Push current dir as private
   tokrepo push --public --title "My MCP" .    # Push dir publicly with title
@@ -2484,6 +2703,9 @@ ${C.bold}tokrepo sync-installed${C.reset}
 
 USAGE
   tokrepo sync-installed --target codex [--dry-run] [--stage] [--update] [--approve-mcp] [--json]
+  tokrepo installed --target codex [--json]
+  tokrepo outdated --target codex [--json]
+  tokrepo update --target codex --all [--stage] [--approve-mcp] [--json]
 
 BEHAVIOR
   Reads ~/.codex/tokrepo/install-manifest.json, fetches each TokRepo asset again,
@@ -2491,6 +2713,9 @@ BEHAVIOR
   changed or missing files. Use --update to force reinstall unchanged assets.
 
 EXAMPLES
+  tokrepo installed --target codex --json
+  tokrepo outdated --target codex --json
+  tokrepo update --target codex --all
   tokrepo sync-installed --target codex --dry-run --json
   tokrepo sync-installed --target codex --stage
   tokrepo sync-installed --target codex --update --approve-mcp
@@ -2513,6 +2738,8 @@ function showCommandHelp(command) {
       showCloneHelp(); break;
     case 'sync-installed':
     case 'sync':
+    case 'installed':
+    case 'outdated':
       showSyncInstalledHelp(); break;
     default:
       showHelp(); break;
@@ -2542,6 +2769,8 @@ async function main() {
     case 'update': await cmdUpdate(); break;
     case 'delete': await cmdDelete(); break;
     case 'clone': await cmdClone(); break;
+    case 'installed': await cmdInstalled(); break;
+    case 'outdated': await cmdOutdated(); break;
     case 'sync-installed': case 'sync': await cmdSyncInstalled(); break;
     case 'tags': await cmdTags(); break;
     case 'status': case 'diff': await cmdStatus(); break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokrepo",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "AI assets for humans and agents — search, install, push. Like GitHub, for AI experience.",
   "bin": {
     "tokrepo": "bin/tokrepo.js"