vet-skills 0.1.0 → 0.3.0

package/README.md

@@ -4,9 +4,10 @@ Check agent skills and MCP servers before they run. Verdicts come from
 [KillerSkills](https://killerskills.ai); the policy is yours or your org's.
 
 ```
-npx skills add killerskills/vet-skills      # soon: the meta-skill
-npm i -g vet-skills                          # the CLI
+npm i -g vet-skills                          # the CLI (Node 20+)
 vet-skills hook install claude-code          # intercept every install in Claude Code
+vet-skills check <skill>                     # or just ask before you add one
+vet-skills publish ./my-skill                # org members: detonate + list in the private registry
 ```
 
 ## What it does

package/dist/index.js

@@ -7629,7 +7629,7 @@ import { mkdirSync, readFileSync, writeFileSync, existsSync, appendFileSync, chm
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
-var VERSION = "0.1.0";
+var VERSION = "0.3.0";
 var HOME = process.env.VET_SKILLS_HOME ?? join(homedir(), ".vet-skills");
 var API = (process.env.KILLERSKILLS_API ?? "https://killerskills.ai").replace(/\/$/, "");
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -7759,7 +7759,7 @@ async function call(path, init = {}, timeoutMs = 8e3) {
 function resolveSkill(q, registry) {
   const qs = new URLSearchParams({ q });
   if (registry) qs.set("registry", registry);
-  return call(`/api/v1/resolve?${qs}`);
+  return call(`/api/v1/resolve?${qs}`, { headers: orgHeaders() });
 }
 function orgHeaders() {
   const token = readToken();
@@ -7778,8 +7778,13 @@ function report(body) {
   if (!org) return Promise.resolve({ ok: false, error: "not joined", offline: false });
   return call(`/api/v1/orgs/${org.slug}/agents/${org.agentId}/report`, { method: "POST", body: JSON.stringify(body), headers: orgHeaders() }, 8e3);
 }
+function publish(tgz) {
+  const org = readOrg();
+  if (!org) return Promise.resolve({ ok: false, status: 0, error: "not enrolled in an organization (vet-skills join <org> --token \u2026)", offline: false });
+  return call(`/api/v1/orgs/${org.slug}/agents/${org.agentId}/publish`, { method: "POST", body: new Blob([tgz]), headers: { "content-type": "application/gzip", ...orgHeaders() } }, 18e4);
+}
 function detonate(tgz, opts = {}) {
-  const q = new URLSearchParams({ registry: opts.registry ?? "private" });
+  const q = new URLSearchParams();
   return call(`/api/v1/detonate?${q}`, { method: "POST", body: new Blob([tgz]), headers: { "content-type": "application/gzip", ...opts.publisher ? { "x-vs-publisher": opts.publisher } : {} } }, 18e4);
 }
 
@@ -7849,7 +7854,12 @@ async function check(q, opts = {}) {
   let source = "api";
   let offline = false;
   let cacheAge;
-  const res = await resolveSkill(q);
+  let res = await resolveSkill(q);
+  if (!res.ok && !res.offline && org) {
+    const bare = q.replace(/^[^/]+\//, "");
+    const priv = await resolveSkill(`${org.slug}/${bare}`, "private");
+    if (priv.ok) res = priv;
+  }
   if (res.ok) {
     resolved = res.data;
     const cached = cacheGet(resolved.version.artifact_hash);
@@ -7985,6 +7995,27 @@ var INSTALL_PATTERNS = [
   { re: /claude\s+mcp\s+add(?:-json)?\s+(\S+)/, kind: "mcp" },
   { re: /vet-skills\s+install\s+(\S+)/, kind: "skill" }
 ];
+function extractRemoteMcp(command) {
+  const m = command.match(/claude\s+mcp\s+add(?:-json)?\s+(.*)$/s);
+  if (!m) return null;
+  const args = (m[1].match(/"[^"]*"|'[^']*'|\S+/g) ?? []).map((a) => a.replace(/^(['"])(.*)\1$/, "$2"));
+  const takesValue = /^(--transport|-t|--scope|-s|--header|-H|--env|-e)$/;
+  const positional = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--") break;
+    if (takesValue.test(a)) {
+      i += 1;
+      continue;
+    }
+    if (a.startsWith("-")) continue;
+    positional.push(a);
+  }
+  const url = positional.find((a) => /^https?:\/\//.test(a));
+  if (!url) return null;
+  const name = positional.find((a) => a !== url) ?? new URL(url).hostname;
+  return { name, url };
+}
 function extractInstall(command) {
   for (const p of INSTALL_PATTERNS) {
     const m = command.match(p.re);
@@ -8006,12 +8037,18 @@ async function hookEval(stdin) {
   if (!found) return 0;
   const r = await check(found.q, { quiet: true, agentKind: "claude_code" });
   const out = renderOutcome(r);
+  const remote = found.kind === "mcp" ? extractRemoteMcp(cmd2) : null;
+  const watch = async () => {
+    if (remote && readOrg()) await report({ installed: [], removed: [], mcp_servers: [remote] }).catch(() => null);
+  };
   switch (r.decision.decision) {
     case "allow":
     case "observe":
+      await watch();
       process.stderr.write(out + "\n");
       return 0;
     case "sandbox":
+      await watch();
       process.stderr.write(out + "\n");
       return 0;
     case "approval_required":
@@ -8087,6 +8124,7 @@ var USAGE = `vet-skills ${VERSION} \u2014 check agent skills and MCP servers bef
   vet-skills check <skill>              dry-run the decision
   vet-skills install <skill>            check, then \`npx skills add\`
   vet-skills detonate <path> [--publisher h] upload a local bundle to the sandbox and print its verdict
+  vet-skills publish <path>             detonate and publish to your organization's private registry
   vet-skills why <skill>                last decision and the rule behind it
   vet-skills join <org> --token <t> [--email you@co]   enroll this machine in an org
   vet-skills leave                      back to the personal policy
@@ -8184,7 +8222,7 @@ async function main() {
       }
       process.stderr.write(`${c.muted("Detonating")} ${basename(dir)} ${c.muted(`(${(tar.stdout.length / 1024).toFixed(0)} KB)`)} \u2026
 `);
-      const res = await detonate(new Uint8Array(tar.stdout), { publisher: values.publisher, registry: values.registry });
+      const res = await detonate(new Uint8Array(tar.stdout), { publisher: values.publisher });
       if (!res.ok) {
         console.log(`${c.caution("!")} Detonation failed (${res.status ?? "offline"}): ${res.error}`);
         return 1;
@@ -8205,6 +8243,42 @@ async function main() {
       console.log(c.muted(`${API}${d.skill.page}`));
       return d.verdict.label === "blocked" ? 2 : 0;
     }
+    case "publish": {
+      if (!rest[0]) {
+        usage();
+        return 1;
+      }
+      const org = readOrg();
+      if (!org) {
+        console.log(`${c.blocked("\u2717")} not enrolled in an organization. Run ${c.bold("vet-skills join <org> --token \u2026")} first.`);
+        return 1;
+      }
+      const dir = resolve(rest[0]);
+      if (!existsSync3(join3(dir, "SKILL.md"))) {
+        console.log(`${c.blocked("\u2717")} ${dir} has no SKILL.md (name and version come from its frontmatter)`);
+        return 1;
+      }
+      const tar = spawnSync("tar", ["--exclude", "node_modules", "--exclude", ".git", "-czf", "-", "-C", dirname(dir), basename(dir)], { maxBuffer: 64 * 1024 * 1024 });
+      if (tar.status !== 0) {
+        console.log(`${c.blocked("\u2717")} tar failed: ${tar.stderr.toString().trim()}`);
+        return 1;
+      }
+      process.stderr.write(`${c.muted("Publishing")} ${basename(dir)} ${c.muted(`to ${org.slug} (${(tar.stdout.length / 1024).toFixed(0)} KB) \u2014 detonating first \u2026`)}
+`);
+      const res = await publish(new Uint8Array(tar.stdout));
+      if (!res.ok) {
+        console.log(`${c.caution("!")} Publish failed (${res.status ?? "offline"}): ${res.error}`);
+        return 1;
+      }
+      const d = res.data;
+      const paint = d.verdict.label === "verified" ? c.verified : d.verdict.label === "caution" ? c.caution : c.blocked;
+      console.log(`${paint(d.verdict.label.toUpperCase())} ${c.bold(String(d.verdict.score))} ${c.muted(`\xB7 ${d.skill.publisher}/${d.skill.name}@${d.skill.semver} \xB7 ${d.skill.created ? "published" : "re-detonated (same bytes already published)"} \xB7 ${d.verdict.duration_ms} ms`)}`);
+      for (const f of d.findings.slice(0, 6)) console.log(`  ${c.muted(f.rule_id)} ${f.severity.padEnd(8)} ${f.title}`);
+      if (d.findings.length > 6) console.log(c.muted(`  \u2026 ${d.findings.length - 6} more`));
+      console.log(c.muted(`${API}/app/${org.slug}/registry  \xB7  ${API}${d.skill.page}`));
+      console.log(c.muted(`Teammates install it with: vet-skills install ${org.slug}/${d.skill.name}`));
+      return d.verdict.label === "blocked" ? 2 : 0;
+    }
     case "why": {
       const log = readLog().filter((e) => !rest[0] || e.skill === rest[0] || `${e.skill}@${e.semver}` === rest[0]);
       const last = log.at(-1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vet-skills",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Vet agent skills and MCP servers before they run. Verdicts from KillerSkills, policy from your org.",
   "type": "module",
   "bin": {