vet-skills 0.4.0 → 0.5.1

package/dist/index.js

@@ -7616,7 +7616,7 @@ import { parseArgs } from "node:util";
 import { spawnSync } from "node:child_process";
 import { readFileSync as readFileSync3, existsSync as existsSync4 } from "node:fs";
 import { resolve, join as join4, dirname, basename } from "node:path";
-import { hostname, platform, userInfo } from "node:os";
+import { hostname, platform as platform2, userInfo } from "node:os";
 import { createHash } from "node:crypto";
 import { createInterface } from "node:readline";
 
@@ -7629,7 +7629,7 @@ import { mkdirSync, readFileSync, writeFileSync, existsSync, appendFileSync, chm
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
-var VERSION = "0.4.0";
+var VERSION = "0.5.1";
 var HOME = process.env.VET_SKILLS_HOME ?? join(homedir(), ".vet-skills");
 var API = (process.env.KILLERSKILLS_API ?? "https://killerskills.ai").replace(/\/$/, "");
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -7735,6 +7735,33 @@ function stateSummary() {
   const sz = (f) => existsSync(join(HOME, f)) ? statSync(join(HOME, f)).size : 0;
   return { home: HOME, cacheEntries: cacheSize(), cacheBytes: sz("cache.json"), logBytes: sz("log.jsonl") };
 }
+function telemetryEnabled() {
+  const env = (process.env.VET_SKILLS_TELEMETRY ?? "").toLowerCase();
+  if (["0", "false", "off", "no"].includes(env)) return false;
+  if (process.env.DO_NOT_TRACK === "1") return false;
+  const p = join(HOME, "telemetry");
+  if (existsSync(p)) return readFileSync(p, "utf8").trim() !== "off";
+  return true;
+}
+function setTelemetry(on2) {
+  ensureHome();
+  writeFileSync(join(HOME, "telemetry"), on2 ? "on\n" : "off\n", { mode: 384 });
+}
+function telemetryNoticePending() {
+  ensureHome();
+  const p = join(HOME, "telemetry-notice");
+  if (existsSync(p)) return false;
+  writeFileSync(p, (/* @__PURE__ */ new Date()).toISOString() + "\n", { mode: 384 });
+  return true;
+}
+function hintOncePerDay(key) {
+  ensureHome();
+  const p = join(HOME, `hint-${key.replace(/[^\w-]/g, "_")}`);
+  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  if (existsSync(p) && readFileSync(p, "utf8").trim() === today) return false;
+  writeFileSync(p, today + "\n", { mode: 384 });
+  return true;
+}
 
 // src/api.ts
 async function call(path, init = {}, timeoutMs = 8e3) {
@@ -7792,6 +7819,12 @@ function detonate(tgz, opts = {}) {
   const q = new URLSearchParams();
   return call(`/api/v1/detonate?${q}`, { method: "POST", body: new Blob([tgz]), headers: { "content-type": "application/gzip", ...opts.publisher ? { "x-vs-publisher": opts.publisher } : {} } }, 18e4);
 }
+function sendTelemetry(body) {
+  return call("/api/v1/telemetry", { method: "POST", body: JSON.stringify(body) }, 1500);
+}
+
+// src/check.ts
+import { platform } from "node:os";
 
 // src/render.ts
 var on = !!process.stdout.isTTY && !process.env.NO_COLOR;
@@ -7859,7 +7892,7 @@ async function check(q, opts = {}) {
   let source = "api";
   let offline = false;
   let cacheAge;
-  let res = await resolveSkill(q);
+  let res = await resolveSkill(q, opts.registry);
   if (!res.ok && !res.offline && org) {
     const bare = q.replace(/^[^/]+\//, "");
     const priv = await resolveSkill(`${org.slug}/${bare}`, "private");
@@ -7908,6 +7941,10 @@ async function check(q, opts = {}) {
     offline,
     requestId: remote?.approvalRequestId
   });
+  if (!org && telemetryEnabled()) {
+    if (telemetryNoticePending()) process.stderr.write(c.muted("vet-skills sends anonymous usage (skill name, version, decision, agent type; never code, prompts or paths). Opt out: vet-skills telemetry off") + "\n");
+    await sendTelemetry({ skill: resolved?.skill.name ?? q, semver: resolved?.version.semver ?? null, registry: resolved?.skill.registry ?? null, decision: decision.decision, would_be: decision.wouldBe ?? null, agent_kind: opts.agentKind ?? "other", hook_version: VERSION, os: platform(), offline }).catch(() => null);
+  }
   return { resolved, decision, source, cacheAge, remote, offline, policyLabel };
 }
 function renderCheck(r) {
@@ -8071,10 +8108,41 @@ function extractRemoteMcp(command) {
   const name = positional.find((a) => a !== url) ?? new URL(url).hostname;
   return { name, url };
 }
+function extractStdioPackage(command) {
+  const tail = command.split(/\s--\s/)[1];
+  if (!tail) return null;
+  const args = (tail.match(/"[^"]*"|'[^']*'|\S+/g) ?? []).map((a) => a.replace(/^(['"])(.*)\1$/, "$2"));
+  const [bin, ...rest2] = args;
+  const strip = (s) => s.replace(/(.)@[^@/]+$/, "$1");
+  if (/^(npx|bunx|pnpm)$/.test(bin ?? "")) {
+    const pkg = rest2.find((a) => !a.startsWith("-") && a !== "dlx" && a !== "exec");
+    return pkg ? { q: strip(pkg).replace(/^@/, ""), registry: "npm" } : null;
+  }
+  if (/^(uvx|pipx)$/.test(bin ?? "")) {
+    const pkg = rest2.find((a) => !a.startsWith("-") && a !== "run");
+    return pkg ? { q: strip(pkg).toLowerCase().replace(/\[.*\]$/, ""), registry: "pypi" } : null;
+  }
+  if (bin === "docker") {
+    const img = rest2.find((a) => /^(ghcr\.io\/|docker\.io\/)?[\w.-]+\/[\w.-]+(:[\w.-]+)?$/.test(a) && !a.startsWith("-"));
+    if (!img) return null;
+    const m = img.replace(/:[\w.-]+$/, "").match(/mcp\/([\w.-]+)$/);
+    return m ? { q: m[1], registry: "docker" } : null;
+  }
+  return null;
+}
 function extractInstall(command) {
   for (const p of INSTALL_PATTERNS) {
     const m = command.match(p.re);
-    if (m) return { q: m[1].replace(/^['"]|['"]$/g, ""), kind: p.kind };
+    if (!m) continue;
+    const q = m[1].replace(/^['"]|['"]$/g, "");
+    if (p.kind === "mcp") {
+      const pkg = extractStdioPackage(command);
+      if (pkg) return { q: pkg.q, kind: "mcp", registry: pkg.registry };
+      const remote = extractRemoteMcp(command);
+      if (remote) return { q: remote.name, kind: "mcp" };
+    }
+    if (p.kind === "plugin") return { q: q.split("@")[0], kind: "plugin", registry: "plugins" };
+    return { q, kind: p.kind };
   }
   return null;
 }
@@ -8090,7 +8158,7 @@ async function hookEval(stdin) {
   if (/^\s*vet-skills\s+(check|why|status|sync|policy|detonate|hook|join|leave|block|publish)\b/.test(cmd2)) return 0;
   const found = extractInstall(cmd2);
   if (!found) return 0;
-  const r = await check(found.q, { quiet: true, agentKind: "claude_code" });
+  const r = await check(found.q, { quiet: true, agentKind: "claude_code", registry: found.registry });
   const out = renderOutcome(r);
   const remote = found.kind === "mcp" ? extractRemoteMcp(cmd2) : null;
   const watch = async () => {
@@ -8122,10 +8190,11 @@ ${out}
 `);
       return 2;
     case "block":
-      process.stderr.write(`vet-skills blocked this install by org policy.
+      process.stderr.write(`vet-skills blocked this install by ${readOrg() ? "org" : "your"} policy.
 ${renderCheck(r)}
 ${out}
 `);
+      if (!readOrg() && hintOncePerDay("teams")) process.stderr.write("Running this for a team? One policy across every developer's agents, approvals and inventory: https://killerskills.ai/pricing\n");
       return 2;
   }
   return 0;
@@ -8180,6 +8249,11 @@ async function ask(question, choices) {
 }
 var USAGE = `vet-skills ${VERSION} \u2014 check agent skills and MCP servers before they run.
 
+Get started:
+  vet-skills hook install claude-code   check every install Claude Code makes (one time)
+  vet-skills check <skill>              see the verdict for anything before installing it
+  vet-skills join <org> --token <t>     enroll this machine in your team's policy (token from the dashboard)
+
   vet-skills check <skill>              dry-run the decision
   vet-skills install <skill>            check, then \`npx skills add\`
   vet-skills detonate <path> [--publisher h] upload a local bundle to the sandbox and print its verdict
@@ -8214,7 +8288,7 @@ async function main() {
         usage();
         return 1;
       }
-      const r = await check(rest[0], { agentKind: values.agent });
+      const r = await check(rest[0], { agentKind: values.agent, registry: values.registry });
       if (values.json) {
         console.log(JSON.stringify({ decision: r.decision, resolved: r.resolved, source: r.source, offline: r.offline }, null, 2));
         return r.decision.decision === "block" ? 2 : 0;
@@ -8365,7 +8439,7 @@ async function main() {
         machine_label: hostname(),
         agent_kind: values.agent ?? "other",
         hook_version: VERSION,
-        os: platform(),
+        os: platform2(),
         installed: [],
         ci: values.ci === true
       });
@@ -8432,6 +8506,16 @@ async function main() {
       console.log(`${c.verified("\u2713")} ${handle} added to the personal block list${values.reason ? ` (${values.reason})` : ""}.`);
       return 0;
     }
+    case "telemetry": {
+      const sub = rest[0] ?? "status";
+      if (sub === "on" || sub === "off") {
+        setTelemetry(sub === "on");
+        console.log(`${c.verified("\u2713")} telemetry ${sub}`);
+        return 0;
+      }
+      console.log(`telemetry ${telemetryEnabled() ? "on" : "off"} ${c.muted(readOrg() ? "(enrolled: decisions report to the org, not here)" : "(anonymous: skill, version, decision, agent type; never code, prompts or paths)")}`);
+      return 0;
+    }
     case "status": {
       const org = readOrg();
       const { policy, source } = readPolicy();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vet-skills",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Vet agent skills and MCP servers before they run. Verdicts from KillerSkills, policy from your org.",
   "type": "module",
   "bin": {