vet-skills 0.5.0 → 0.5.2

package/dist/index.js

@@ -7616,7 +7616,7 @@ import { parseArgs } from "node:util";
 import { spawnSync } from "node:child_process";
 import { readFileSync as readFileSync3, existsSync as existsSync4 } from "node:fs";
 import { resolve, join as join4, dirname, basename } from "node:path";
-import { hostname, platform, userInfo } from "node:os";
+import { hostname, platform as platform2, userInfo } from "node:os";
 import { createHash } from "node:crypto";
 import { createInterface } from "node:readline";
 
@@ -7629,7 +7629,7 @@ import { mkdirSync, readFileSync, writeFileSync, existsSync, appendFileSync, chm
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
-var VERSION = "0.5.0";
+var VERSION = "0.5.2";
 var HOME = process.env.VET_SKILLS_HOME ?? join(homedir(), ".vet-skills");
 var API = (process.env.KILLERSKILLS_API ?? "https://killerskills.ai").replace(/\/$/, "");
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -7735,6 +7735,33 @@ function stateSummary() {
   const sz = (f) => existsSync(join(HOME, f)) ? statSync(join(HOME, f)).size : 0;
   return { home: HOME, cacheEntries: cacheSize(), cacheBytes: sz("cache.json"), logBytes: sz("log.jsonl") };
 }
+function telemetryEnabled() {
+  const env = (process.env.VET_SKILLS_TELEMETRY ?? "").toLowerCase();
+  if (["0", "false", "off", "no"].includes(env)) return false;
+  if (process.env.DO_NOT_TRACK === "1") return false;
+  const p = join(HOME, "telemetry");
+  if (existsSync(p)) return readFileSync(p, "utf8").trim() !== "off";
+  return true;
+}
+function setTelemetry(on2) {
+  ensureHome();
+  writeFileSync(join(HOME, "telemetry"), on2 ? "on\n" : "off\n", { mode: 384 });
+}
+function telemetryNoticePending() {
+  ensureHome();
+  const p = join(HOME, "telemetry-notice");
+  if (existsSync(p)) return false;
+  writeFileSync(p, (/* @__PURE__ */ new Date()).toISOString() + "\n", { mode: 384 });
+  return true;
+}
+function hintOncePerDay(key) {
+  ensureHome();
+  const p = join(HOME, `hint-${key.replace(/[^\w-]/g, "_")}`);
+  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  if (existsSync(p) && readFileSync(p, "utf8").trim() === today) return false;
+  writeFileSync(p, today + "\n", { mode: 384 });
+  return true;
+}
 
 // src/api.ts
 async function call(path, init = {}, timeoutMs = 8e3) {
@@ -7792,6 +7819,12 @@ function detonate(tgz, opts = {}) {
   const q = new URLSearchParams();
   return call(`/api/v1/detonate?${q}`, { method: "POST", body: new Blob([tgz]), headers: { "content-type": "application/gzip", ...opts.publisher ? { "x-vs-publisher": opts.publisher } : {} } }, 18e4);
 }
+function sendTelemetry(body) {
+  return call("/api/v1/telemetry", { method: "POST", body: JSON.stringify(body) }, 1500);
+}
+
+// src/check.ts
+import { platform } from "node:os";
 
 // src/render.ts
 var on = !!process.stdout.isTTY && !process.env.NO_COLOR;
@@ -7908,6 +7941,10 @@ async function check(q, opts = {}) {
     offline,
     requestId: remote?.approvalRequestId
   });
+  if (!org && telemetryEnabled()) {
+    if (telemetryNoticePending()) process.stderr.write(c.muted("vet-skills sends anonymous usage (skill name, version, decision, agent type; never code, prompts or paths). Opt out: vet-skills telemetry off") + "\n");
+    await sendTelemetry({ skill: resolved?.skill.name ?? q, semver: resolved?.version.semver ?? null, registry: resolved?.skill.registry ?? null, decision: decision.decision, would_be: decision.wouldBe ?? null, agent_kind: opts.agentKind ?? "other", hook_version: VERSION, os: platform(), offline }).catch(() => null);
+  }
   return { resolved, decision, source, cacheAge, remote, offline, policyLabel };
 }
 function renderCheck(r) {
@@ -8153,10 +8190,11 @@ ${out}
 `);
       return 2;
     case "block":
-      process.stderr.write(`vet-skills blocked this install by org policy.
+      process.stderr.write(`vet-skills blocked this install by ${readOrg() ? "org" : "your"} policy.
 ${renderCheck(r)}
 ${out}
 `);
+      if (!readOrg() && hintOncePerDay("teams")) process.stderr.write("Running this for a team? One policy across every developer's agents, approvals and inventory: https://killerskills.ai/pricing\n");
       return 2;
   }
   return 0;
@@ -8211,6 +8249,11 @@ async function ask(question, choices) {
 }
 var USAGE = `vet-skills ${VERSION} \u2014 check agent skills and MCP servers before they run.
 
+Get started:
+  vet-skills hook install claude-code   check every install Claude Code makes (one time)
+  vet-skills check <skill>              see the verdict for anything before installing it
+  vet-skills join <org> --token <t>     enroll this machine in your team's policy (token from the dashboard)
+
   vet-skills check <skill>              dry-run the decision
   vet-skills install <skill>            check, then \`npx skills add\`
   vet-skills detonate <path> [--publisher h] upload a local bundle to the sandbox and print its verdict
@@ -8396,7 +8439,7 @@ async function main() {
         machine_label: hostname(),
         agent_kind: values.agent ?? "other",
         hook_version: VERSION,
-        os: platform(),
+        os: platform2(),
         installed: [],
         ci: values.ci === true
       });
@@ -8463,6 +8506,25 @@ async function main() {
       console.log(`${c.verified("\u2713")} ${handle} added to the personal block list${values.reason ? ` (${values.reason})` : ""}.`);
       return 0;
     }
+    case "bug": {
+      const last = readLog().at(-1);
+      const qs = new URLSearchParams({ kind: "bug", source: "cli", cli_version: VERSION, ...last ? { skill: `${last.skill}@${last.semver}`, decision: last.decision } : {} });
+      const url = `${API}/feedback?${qs}`;
+      console.log(`Report a bug: ${url}`);
+      const opener = platform2() === "darwin" ? "open" : platform2() === "win32" ? "start" : "xdg-open";
+      spawnSync(opener, [url], { stdio: "ignore", shell: platform2() === "win32" });
+      return 0;
+    }
+    case "telemetry": {
+      const sub = rest[0] ?? "status";
+      if (sub === "on" || sub === "off") {
+        setTelemetry(sub === "on");
+        console.log(`${c.verified("\u2713")} telemetry ${sub}`);
+        return 0;
+      }
+      console.log(`telemetry ${telemetryEnabled() ? "on" : "off"} ${c.muted(readOrg() ? "(enrolled: decisions report to the org, not here)" : "(anonymous: skill, version, decision, agent type; never code, prompts or paths)")}`);
+      return 0;
+    }
     case "status": {
       const org = readOrg();
       const { policy, source } = readPolicy();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vet-skills",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Vet agent skills and MCP servers before they run. Verdicts from KillerSkills, policy from your org.",
   "type": "module",
   "bin": {