vet-skills 0.2.0 → 0.3.0

package/dist/index.js

@@ -7629,7 +7629,7 @@ import { mkdirSync, readFileSync, writeFileSync, existsSync, appendFileSync, chm
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
-var VERSION = "0.2.0";
+var VERSION = "0.3.0";
 var HOME = process.env.VET_SKILLS_HOME ?? join(homedir(), ".vet-skills");
 var API = (process.env.KILLERSKILLS_API ?? "https://killerskills.ai").replace(/\/$/, "");
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -7995,6 +7995,27 @@ var INSTALL_PATTERNS = [
   { re: /claude\s+mcp\s+add(?:-json)?\s+(\S+)/, kind: "mcp" },
   { re: /vet-skills\s+install\s+(\S+)/, kind: "skill" }
 ];
+function extractRemoteMcp(command) {
+  const m = command.match(/claude\s+mcp\s+add(?:-json)?\s+(.*)$/s);
+  if (!m) return null;
+  const args = (m[1].match(/"[^"]*"|'[^']*'|\S+/g) ?? []).map((a) => a.replace(/^(['"])(.*)\1$/, "$2"));
+  const takesValue = /^(--transport|-t|--scope|-s|--header|-H|--env|-e)$/;
+  const positional = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--") break;
+    if (takesValue.test(a)) {
+      i += 1;
+      continue;
+    }
+    if (a.startsWith("-")) continue;
+    positional.push(a);
+  }
+  const url = positional.find((a) => /^https?:\/\//.test(a));
+  if (!url) return null;
+  const name = positional.find((a) => a !== url) ?? new URL(url).hostname;
+  return { name, url };
+}
 function extractInstall(command) {
   for (const p of INSTALL_PATTERNS) {
     const m = command.match(p.re);
@@ -8016,12 +8037,18 @@ async function hookEval(stdin) {
   if (!found) return 0;
   const r = await check(found.q, { quiet: true, agentKind: "claude_code" });
   const out = renderOutcome(r);
+  const remote = found.kind === "mcp" ? extractRemoteMcp(cmd2) : null;
+  const watch = async () => {
+    if (remote && readOrg()) await report({ installed: [], removed: [], mcp_servers: [remote] }).catch(() => null);
+  };
   switch (r.decision.decision) {
     case "allow":
     case "observe":
+      await watch();
       process.stderr.write(out + "\n");
       return 0;
     case "sandbox":
+      await watch();
       process.stderr.write(out + "\n");
       return 0;
     case "approval_required":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vet-skills",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Vet agent skills and MCP servers before they run. Verdicts from KillerSkills, policy from your org.",
   "type": "module",
   "bin": {