vskill 0.5.140 → 0.5.141

package/agents.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "generatedAt": "2026-04-26T18:39:18.872Z",
+  "generatedAt": "2026-04-26T19:11:59.758Z",
   "agentPrefixes": [
     ".adal",
     ".agent",

package/dist/eval-server/api-routes.d.ts

@@ -28,6 +28,7 @@ export interface AgentScopeEntry {
     isDefault: boolean;
     localSkillCount: number;
     globalSkillCount: number;
+    pluginSkillCount: number;
     resolvedLocalDir: string;
     resolvedGlobalDir: string;
     lastSync: string | null;
@@ -111,6 +112,40 @@ export declare function parseSkillFrontmatter(content: string): Record<string, s
  * for `origin="source"` or if no registry entry matches.
  */
 export declare function deriveSourceAgent(skillDir: string, root: string, origin: "source" | "installed"): string | null;
+/**
+ * 0770 — Pure regex parser. Normalizes any github.com origin remote
+ * (SSH, HTTPS, ssh://) to its canonical `https://github.com/owner/repo`
+ * form (no `.git` suffix, no trailing path). Returns null for non-github
+ * hosts, malformed input, empty/whitespace strings.
+ */
+export declare function parseGithubRemote(remote: string | null | undefined): string | null;
+/**
+ * 0770 — Walk parent directories from `startDir` looking for a `.git` entry
+ * (directory OR file — git worktrees use a `.git` file). Bails at the
+ * filesystem root or after `maxLevels` iterations. Returns the absolute
+ * path of the discovered git root, or null.
+ */
+export declare function walkUpForGitRoot(startDir: string, maxLevels?: number): string | null;
+/**
+ * 0770 — Test-only helper to clear the module-level memoization cache so
+ * tests can isolate detection runs across `beforeEach`.
+ */
+export declare function resetAuthoredSourceLinkCache(): void;
+/**
+ * 0770 — Detect source-repo provenance for a locally-authored skill (no
+ * lockfile entry). Walks for `.git`, reads `origin` remote, normalizes via
+ * `parseGithubRemote`, and computes `skillPath` from `git ls-files` (with a
+ * filesystem fallback for untracked SKILL.md files). Memoized per absolute
+ * skill dir for the eval-server process lifetime.
+ *
+ * All git invocations use `execFileSync` with explicit argv (no shell), a
+ * 1500ms hard timeout, and silenced stderr. Any error converts to
+ * `{null, null}` — `buildSkillMetadata` never throws because of git.
+ */
+export declare function detectAuthoredSourceLink(skillDir: string): {
+    repoUrl: string | null;
+    skillPath: string | null;
+};
 /**
  * Build the T-025 metadata payload for a single skill. Reads SKILL.md from
  * disk if present; returns EMPTY_METADATA on any error so the /api/skills

package/dist/eval-server/api-routes.js

@@ -3,7 +3,7 @@
 // ---------------------------------------------------------------------------
 import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, statSync } from "node:fs";
 import { execSync, execFileSync } from "node:child_process";
-import { join, resolve, dirname, basename } from "node:path";
+import { join, resolve, dirname, basename, relative } from "node:path";
 import { homedir } from "node:os";
 import { sendJson, readBody } from "./router.js";
 import { initSSE, sendSSE, sendSSEDone, withHeartbeat, startDynamicHeartbeat } from "./sse-helpers.js";
@@ -122,6 +122,14 @@ export async function buildAgentsResponse(opts) {
         agentPresenceCache.binariesKey === cacheKey.binariesKey) {
         return agentPresenceCache.data;
     }
+    // 0772 US-002: count plugin skills once for claude-code. The plugin scanner
+    // walks ~/.claude/plugins/cache/<marketplace>/<plugin>/<version>/skills/, so
+    // the result is independent of agent identity (plugins are CC-only by
+    // current registry design). Pass `home` so tests can override the homedir.
+    const claudePluginCount = scanInstalledPluginSkills({
+        agentId: "claude-code",
+        home,
+    }).length;
     // Map each agent → resolved local + global dir. For tests, `home` overrides
     // the homedir-derived global path. In production, resolveGlobalSkillsDir()
     // handles cross-platform resolution (darwin / linux / win32).
@@ -167,6 +175,7 @@ export async function buildAgentsResponse(opts) {
             isDefault,
             localSkillCount,
             globalSkillCount,
+            pluginSkillCount: agent.id === "claude-code" ? claudePluginCount : 0,
             resolvedLocalDir,
             resolvedGlobalDir,
             lastSync,
@@ -597,6 +606,116 @@ export function deriveSourceAgent(skillDir, root, origin) {
     }
     return null;
 }
+/**
+ * 0770 — Pure regex parser. Normalizes any github.com origin remote
+ * (SSH, HTTPS, ssh://) to its canonical `https://github.com/owner/repo`
+ * form (no `.git` suffix, no trailing path). Returns null for non-github
+ * hosts, malformed input, empty/whitespace strings.
+ */
+export function parseGithubRemote(remote) {
+    const trimmed = (remote ?? "").trim();
+    if (!trimmed)
+        return null;
+    // SSH: git@github.com:owner/repo[.git]
+    let m = /^git@github\.com:([^/\s]+)\/([^/\s]+?)(?:\.git)?$/.exec(trimmed);
+    if (m)
+        return `https://github.com/${m[1]}/${m[2]}`;
+    // ssh://git@github.com/owner/repo[.git]
+    m = /^ssh:\/\/git@github\.com\/([^/\s]+)\/([^/\s]+?)(?:\.git)?$/.exec(trimmed);
+    if (m)
+        return `https://github.com/${m[1]}/${m[2]}`;
+    // http(s)://github.com/owner/repo[.git][/...]
+    m = /^https?:\/\/github\.com\/([^/\s]+)\/([^/\s?#]+?)(?:\.git)?(?:[/?#].*)?$/.exec(trimmed);
+    if (m)
+        return `https://github.com/${m[1]}/${m[2]}`;
+    return null;
+}
+/**
+ * 0770 — Walk parent directories from `startDir` looking for a `.git` entry
+ * (directory OR file — git worktrees use a `.git` file). Bails at the
+ * filesystem root or after `maxLevels` iterations. Returns the absolute
+ * path of the discovered git root, or null.
+ */
+export function walkUpForGitRoot(startDir, maxLevels = 12) {
+    let current = resolve(startDir);
+    for (let i = 0; i < maxLevels; i++) {
+        if (existsSync(join(current, ".git")))
+            return current;
+        const parent = dirname(current);
+        if (parent === current)
+            return null;
+        current = parent;
+    }
+    return null;
+}
+const authoredSourceLinkCache = new Map();
+/**
+ * 0770 — Test-only helper to clear the module-level memoization cache so
+ * tests can isolate detection runs across `beforeEach`.
+ */
+export function resetAuthoredSourceLinkCache() {
+    authoredSourceLinkCache.clear();
+}
+/**
+ * 0770 — Detect source-repo provenance for a locally-authored skill (no
+ * lockfile entry). Walks for `.git`, reads `origin` remote, normalizes via
+ * `parseGithubRemote`, and computes `skillPath` from `git ls-files` (with a
+ * filesystem fallback for untracked SKILL.md files). Memoized per absolute
+ * skill dir for the eval-server process lifetime.
+ *
+ * All git invocations use `execFileSync` with explicit argv (no shell), a
+ * 1500ms hard timeout, and silenced stderr. Any error converts to
+ * `{null, null}` — `buildSkillMetadata` never throws because of git.
+ */
+export function detectAuthoredSourceLink(skillDir) {
+    const absDir = resolve(skillDir);
+    const cached = authoredSourceLinkCache.get(absDir);
+    if (cached)
+        return cached;
+    const compute = () => {
+        const gitRoot = walkUpForGitRoot(absDir);
+        if (!gitRoot)
+            return { repoUrl: null, skillPath: null };
+        let remote = "";
+        try {
+            remote = execFileSync("git", ["config", "--get", "remote.origin.url"], {
+                cwd: gitRoot,
+                timeout: 1500,
+                stdio: ["ignore", "pipe", "ignore"],
+                encoding: "utf-8",
+            }).trim();
+        }
+        catch {
+            return { repoUrl: null, skillPath: null };
+        }
+        const repoUrl = parseGithubRemote(remote);
+        if (!repoUrl)
+            return { repoUrl: null, skillPath: null };
+        let skillPath = null;
+        try {
+            const tracked = execFileSync("git", ["ls-files", "--full-name", "SKILL.md"], {
+                cwd: absDir,
+                timeout: 1500,
+                stdio: ["ignore", "pipe", "ignore"],
+                encoding: "utf-8",
+            }).trim();
+            if (tracked)
+                skillPath = tracked;
+        }
+        catch {
+            // fall through to filesystem fallback
+        }
+        if (!skillPath) {
+            // Filesystem fallback for untracked SKILL.md — same path the file will
+            // have on github.com once committed and pushed.
+            skillPath = relative(gitRoot, join(absDir, "SKILL.md")).replace(/\\/g, "/");
+        }
+        return { repoUrl, skillPath };
+    };
+    const result = compute();
+    authoredSourceLinkCache.set(absDir, result);
+    return result;
+}
 /**
  * 0737 — Resolve the source-repo provenance (repoUrl + skillPath) for a
  * skill by looking up its lockfile entry. Two precedences:
@@ -608,19 +727,20 @@ export function deriveSourceAgent(skillDir, root, origin) {
  * skill dir basename and the lockfile key differ — fall back to the parent
  * directory's basename when no exact match exists.
  *
- * Returns `{ null, null }` for any non-github source (e.g.
- * `marketplace:specweave/sw#name`) — guessing a repo URL would produce
- * broken anchors. Authored skills (no lockfile entry) also return null.
+ * 0770 — When no lockfile entry resolves provenance, fall through to
+ * `detectAuthoredSourceLink` which inspects the parent git repo's origin
+ * remote. Lockfile-derived values still take precedence to preserve
+ * install-time provenance when the workspace itself is a git repo.
  */
 function resolveSourceLink(skillDir, root) {
     const lock = readLockfile(root);
     if (!lock)
-        return { repoUrl: null, skillPath: null };
+        return detectAuthoredSourceLink(skillDir);
     const skillName = basename(skillDir);
     const parentName = basename(dirname(skillDir));
     const entry = lock.skills[skillName] ?? lock.skills[parentName];
     if (!entry)
-        return { repoUrl: null, skillPath: null };
+        return detectAuthoredSourceLink(skillDir);
     if (entry.sourceRepoUrl) {
         return {
             repoUrl: entry.sourceRepoUrl,
@@ -636,6 +756,9 @@ function resolveSourceLink(skillDir, root) {
     // copy-chip (local path); a fresh `vskill add` writes the explicit
     // `sourceSkillPath` and restores the working anchor via the branch above.
     const m = /^github:([^/]+)\/([^/#]+)/.exec(entry.source ?? "");
+    // 0770: do NOT fall through here — an installed skill with a non-github
+    // `source` (e.g. `marketplace:...`) is still installed, not authored. Local
+    // git detection would leak the workspace remote (umbrella, etc.).
     if (!m)
         return { repoUrl: null, skillPath: null };
     return {