vet-skills 0.4.0 → 0.5.0

package/dist/index.js

@@ -7629,7 +7629,7 @@ import { mkdirSync, readFileSync, writeFileSync, existsSync, appendFileSync, chm
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
-var VERSION = "0.4.0";
+var VERSION = "0.5.0";
 var HOME = process.env.VET_SKILLS_HOME ?? join(homedir(), ".vet-skills");
 var API = (process.env.KILLERSKILLS_API ?? "https://killerskills.ai").replace(/\/$/, "");
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -7859,7 +7859,7 @@ async function check(q, opts = {}) {
   let source = "api";
   let offline = false;
   let cacheAge;
-  let res = await resolveSkill(q);
+  let res = await resolveSkill(q, opts.registry);
   if (!res.ok && !res.offline && org) {
     const bare = q.replace(/^[^/]+\//, "");
     const priv = await resolveSkill(`${org.slug}/${bare}`, "private");
@@ -8071,10 +8071,41 @@ function extractRemoteMcp(command) {
   const name = positional.find((a) => a !== url) ?? new URL(url).hostname;
   return { name, url };
 }
+function extractStdioPackage(command) {
+  const tail = command.split(/\s--\s/)[1];
+  if (!tail) return null;
+  const args = (tail.match(/"[^"]*"|'[^']*'|\S+/g) ?? []).map((a) => a.replace(/^(['"])(.*)\1$/, "$2"));
+  const [bin, ...rest2] = args;
+  const strip = (s) => s.replace(/(.)@[^@/]+$/, "$1");
+  if (/^(npx|bunx|pnpm)$/.test(bin ?? "")) {
+    const pkg = rest2.find((a) => !a.startsWith("-") && a !== "dlx" && a !== "exec");
+    return pkg ? { q: strip(pkg).replace(/^@/, ""), registry: "npm" } : null;
+  }
+  if (/^(uvx|pipx)$/.test(bin ?? "")) {
+    const pkg = rest2.find((a) => !a.startsWith("-") && a !== "run");
+    return pkg ? { q: strip(pkg).toLowerCase().replace(/\[.*\]$/, ""), registry: "pypi" } : null;
+  }
+  if (bin === "docker") {
+    const img = rest2.find((a) => /^(ghcr\.io\/|docker\.io\/)?[\w.-]+\/[\w.-]+(:[\w.-]+)?$/.test(a) && !a.startsWith("-"));
+    if (!img) return null;
+    const m = img.replace(/:[\w.-]+$/, "").match(/mcp\/([\w.-]+)$/);
+    return m ? { q: m[1], registry: "docker" } : null;
+  }
+  return null;
+}
 function extractInstall(command) {
   for (const p of INSTALL_PATTERNS) {
     const m = command.match(p.re);
-    if (m) return { q: m[1].replace(/^['"]|['"]$/g, ""), kind: p.kind };
+    if (!m) continue;
+    const q = m[1].replace(/^['"]|['"]$/g, "");
+    if (p.kind === "mcp") {
+      const pkg = extractStdioPackage(command);
+      if (pkg) return { q: pkg.q, kind: "mcp", registry: pkg.registry };
+      const remote = extractRemoteMcp(command);
+      if (remote) return { q: remote.name, kind: "mcp" };
+    }
+    if (p.kind === "plugin") return { q: q.split("@")[0], kind: "plugin", registry: "plugins" };
+    return { q, kind: p.kind };
   }
   return null;
 }
@@ -8090,7 +8121,7 @@ async function hookEval(stdin) {
   if (/^\s*vet-skills\s+(check|why|status|sync|policy|detonate|hook|join|leave|block|publish)\b/.test(cmd2)) return 0;
   const found = extractInstall(cmd2);
   if (!found) return 0;
-  const r = await check(found.q, { quiet: true, agentKind: "claude_code" });
+  const r = await check(found.q, { quiet: true, agentKind: "claude_code", registry: found.registry });
   const out = renderOutcome(r);
   const remote = found.kind === "mcp" ? extractRemoteMcp(cmd2) : null;
   const watch = async () => {
@@ -8214,7 +8245,7 @@ async function main() {
         usage();
         return 1;
       }
-      const r = await check(rest[0], { agentKind: values.agent });
+      const r = await check(rest[0], { agentKind: values.agent, registry: values.registry });
       if (values.json) {
         console.log(JSON.stringify({ decision: r.decision, resolved: r.resolved, source: r.source, offline: r.offline }, null, 2));
         return r.decision.decision === "block" ? 2 : 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vet-skills",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Vet agent skills and MCP servers before they run. Verdicts from KillerSkills, policy from your org.",
   "type": "module",
   "bin": {