zora-agent 0.10.0 → 0.10.2

package/dist/skills/skill-auditor.js

@@ -0,0 +1,89 @@
+/**
+ * SkillAuditor — Scans all installed skills at session start.
+ *
+ * Catches skills that were installed manually (git clone, copy-paste, etc.)
+ * without going through the secure install flow. Runs as a SessionStart check.
+ *
+ * Checks all three skill layers:
+ *   ~/.claude/skills/         (global — primary store)
+ *   .zora/skills/             (project-local)
+ *   <package>/skills/         (built-in)
+ *
+ * If any installed skill has critical findings, logs a warning and optionally
+ * blocks session start (configurable via policy.toml).
+ */
+import path from 'node:path';
+import os from 'node:os';
+import fs from 'node:fs/promises';
+import { scanSkillDir, formatScanReport } from './skill-scanner.js';
+import { getSkillLayers } from './skill-loader.js';
+// ─── Auditor ─────────────────────────────────────────────────────────────────
+export async function auditInstalledSkills(options = {}) {
+    const threshold = options.severityThreshold ?? 'high';
+    // Collect skill directories to scan
+    // Includes ~/.claude/skills/ (where Claude Code skills actually live) in addition
+    // to the Zora skill layers (.zora/skills/, ~/.zora/skills/, built-in)
+    const claudeSkillsDir = path.join(os.homedir(), '.claude', 'skills');
+    const layers = options.skillsDirs
+        ? options.skillsDirs.map((d) => ({ dir: d }))
+        : [{ dir: claudeSkillsDir }, ...getSkillLayers()];
+    const flagged = [];
+    let totalSkills = 0;
+    for (const { dir } of layers) {
+        let entries;
+        try {
+            const dirents = await fs.readdir(dir, { withFileTypes: true });
+            entries = dirents.filter((e) => e.isDirectory()).map((e) => e.name);
+        }
+        catch {
+            continue; // layer doesn't exist — fine
+        }
+        for (const skillName of entries) {
+            const skillDir = path.join(dir, skillName);
+            // Must contain SKILL.md to be a valid skill
+            try {
+                await fs.access(path.join(skillDir, 'SKILL.md'));
+            }
+            catch {
+                continue;
+            }
+            totalSkills++;
+            const result = await scanSkillDir(skillDir, { severityThreshold: threshold });
+            if (!result.passed) {
+                flagged.push(result);
+                if (options.failFast)
+                    break;
+            }
+        }
+        if (options.failFast && flagged.length > 0)
+            break;
+    }
+    const clean = flagged.length === 0;
+    const summaryLines = [
+        `Skill audit: ${totalSkills} installed skill(s) checked`,
+        clean
+            ? `✅ All skills passed (threshold: ${threshold})`
+            : `⚠️  ${flagged.length} skill(s) flagged — may have been installed without security scan`,
+    ];
+    for (const r of flagged) {
+        summaryLines.push(formatScanReport(r));
+    }
+    return {
+        clean,
+        totalSkills,
+        flaggedSkills: flagged,
+        summary: summaryLines.join('\n'),
+    };
+}
+/**
+ * Lightweight check — returns true if any installed skill has critical findings.
+ * Used by SessionStart hook for a fast gate without full report.
+ */
+export async function hasUnsafeInstalledSkills() {
+    const report = await auditInstalledSkills({
+        severityThreshold: 'critical',
+        failFast: true,
+    });
+    return !report.clean;
+}
+//# sourceMappingURL=skill-auditor.js.map

package/dist/skills/skill-auditor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-auditor.js","sourceRoot":"","sources":["../../src/skills/skill-auditor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAyC,MAAM,oBAAoB,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAoBnD,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAwB,EAAE;IAE1B,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC;IAEtD,oCAAoC;IACpC,kFAAkF;IAClF,sEAAsE;IACtE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU;QAC/B,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,GAAG,cAAc,EAAE,CAAC,CAAC;IAEpD,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;QAC7B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,6BAA6B;QACzC,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;YAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAE3C,4CAA4C;YAC5C,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,WAAW,EAAE,CAAC;YAEd,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC;YAC9E,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,IAAI,OAAO,CAAC,QAAQ;oBAAE,MAAM;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM;IACpD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IAEnC,MAAM,YAAY,GAAa;QAC7B,gBAAgB,WAAW,6BAA6B;QACxD,KAAK;YACH,CAAC,CAAC,mCAAmC,SAAS,GAAG;YACjD,CAAC,CAAC,OAAO,OAAO,CAAC,MAAM,mEAAmE;KAC7F,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,OAAO;QACL,KAAK;QACL,WAAW;QACX,aAAa,EAAE,OAAO;QACtB,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;QACxC,iBAAiB,EAAE,UAAU;QAC7B,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;AACvB,CAAC"}

package/dist/skills/skill-installer.d.ts

@@ -0,0 +1,41 @@
+/**
+ * SkillInstaller — Extracts and installs .skill / .zip packages.
+ *
+ * A .skill file is a renamed .zip containing a skill directory:
+ *   skill-name/
+ *     SKILL.md      (required)
+ *     scripts/      (optional)
+ *     references/   (optional)
+ *     assets/       (optional)
+ *
+ * Flow:
+ *   1. Validate extension (.skill or .zip)
+ *   2. Extract to temp dir
+ *   3. Validate structure (SKILL.md present, name matches dir)
+ *   4. Run security scan
+ *   5. If clean (or --force): move to target skills dir
+ *   6. Cleanup temp dir
+ */
+import { type FindingSeverity } from './skill-scanner.js';
+export interface InstallOptions {
+    /** Install to .zora/skills/ (project-local) instead of ~/.claude/skills/ (global) */
+    target?: 'global' | 'project';
+    /** Block installs with findings at or above this severity (default: high) */
+    severityThreshold?: FindingSeverity;
+    /** Install despite security findings */
+    force?: boolean;
+    /** Scan only — do not install */
+    dryRun?: boolean;
+    /** Override project directory for 'project' target (defaults to cwd) */
+    cwd?: string;
+}
+export interface InstallResult {
+    skillName: string;
+    installed: boolean;
+    installPath?: string;
+    scanPassed: boolean;
+    report: string;
+    blockedBy?: string;
+}
+export declare function installSkill(skillFilePath: string, options?: InstallOptions): Promise<InstallResult>;
+//# sourceMappingURL=skill-installer.d.ts.map

package/dist/skills/skill-installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installer.d.ts","sourceRoot":"","sources":["../../src/skills/skill-installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAMH,OAAO,EAAkC,KAAK,eAAe,EAAiB,MAAM,oBAAoB,CAAC;AAIzG,MAAM,WAAW,cAAc;IAC7B,qFAAqF;IACrF,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC9B,6EAA6E;IAC7E,iBAAiB,CAAC,EAAE,eAAe,CAAC;IACpC,wCAAwC;IACxC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,iCAAiC;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAwBD,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAmHxB"}

package/dist/skills/skill-installer.js

@@ -0,0 +1,141 @@
+/**
+ * SkillInstaller — Extracts and installs .skill / .zip packages.
+ *
+ * A .skill file is a renamed .zip containing a skill directory:
+ *   skill-name/
+ *     SKILL.md      (required)
+ *     scripts/      (optional)
+ *     references/   (optional)
+ *     assets/       (optional)
+ *
+ * Flow:
+ *   1. Validate extension (.skill or .zip)
+ *   2. Extract to temp dir
+ *   3. Validate structure (SKILL.md present, name matches dir)
+ *   4. Run security scan
+ *   5. If clean (or --force): move to target skills dir
+ *   6. Cleanup temp dir
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import AdmZip from 'adm-zip';
+import { scanSkillDir, formatScanReport, SEVERITY_RANK } from './skill-scanner.js';
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+function getTargetDir(options) {
+    if (options.target === 'project') {
+        return path.join(options.cwd ?? process.cwd(), '.zora', 'skills');
+    }
+    return path.join(os.homedir(), '.claude', 'skills');
+}
+/** Parse name from SKILL.md frontmatter */
+async function readSkillName(skillMdPath) {
+    try {
+        const content = await fs.readFile(skillMdPath, 'utf-8');
+        const match = content.match(/^---\n[\s\S]*?name:\s*([^\n]+)/m);
+        return match?.[1]?.trim() ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+// ─── Installer ───────────────────────────────────────────────────────────────
+export async function installSkill(skillFilePath, options = {}) {
+    const ext = path.extname(skillFilePath).toLowerCase();
+    if (ext !== '.skill' && ext !== '.zip') {
+        throw new Error(`Expected a .skill or .zip file, got: ${ext}`);
+    }
+    // 1. Extract to temp dir
+    const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), 'zora-skill-'));
+    try {
+        let zip;
+        try {
+            zip = new AdmZip(skillFilePath);
+        }
+        catch (err) {
+            throw new Error(`Cannot read archive: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        zip.extractAllTo(tempDir, true);
+        // 2. Find the skill directory inside the extracted content
+        //    The archive should contain exactly one top-level directory.
+        const entries = await fs.readdir(tempDir, { withFileTypes: true });
+        const dirs = entries.filter((e) => e.isDirectory());
+        if (dirs.length === 0) {
+            throw new Error('Archive contains no directory. Expected: skill-name/SKILL.md');
+        }
+        if (dirs.length > 1) {
+            throw new Error(`Archive contains ${dirs.length} top-level directories. Expected exactly one skill directory.`);
+        }
+        const skillDir = path.join(tempDir, dirs[0].name);
+        const dirName = dirs[0].name;
+        // 3. Validate SKILL.md present
+        const skillMdPath = path.join(skillDir, 'SKILL.md');
+        try {
+            await fs.access(skillMdPath);
+        }
+        catch {
+            throw new Error(`Archive is missing SKILL.md in ${dirName}/. Not a valid skill package.`);
+        }
+        // 4. Validate name in SKILL.md matches directory name
+        const declaredName = await readSkillName(skillMdPath);
+        if (declaredName && declaredName !== dirName) {
+            throw new Error(`SKILL.md declares name: "${declaredName}" but directory is named "${dirName}". ` +
+                `Per spec, they must match.`);
+        }
+        const skillName = declaredName ?? dirName;
+        // 5. Security scan
+        const scanResult = await scanSkillDir(skillDir, {
+            severityThreshold: options.severityThreshold ?? 'high',
+        });
+        const report = formatScanReport(scanResult);
+        if (!scanResult.passed && !options.force) {
+            const threshold = options.severityThreshold ?? 'high';
+            const thresholdRank = SEVERITY_RANK[threshold] ?? 0;
+            const blockedCount = scanResult.findings.filter((f) => (SEVERITY_RANK[f.severity] ?? 0) >= thresholdRank).length;
+            return {
+                skillName,
+                installed: false,
+                scanPassed: false,
+                report,
+                blockedBy: `${blockedCount} finding(s) at or above ${threshold} severity. Use --force to override.`,
+            };
+        }
+        if (options.dryRun) {
+            return {
+                skillName,
+                installed: false,
+                scanPassed: scanResult.passed,
+                report: report + '\n\n[dry-run] Scan complete. Not installed.',
+            };
+        }
+        // 6. Atomic install — copy to temp dir in target, then rename
+        // This ensures a valid version (old or new) always exists if something fails mid-copy
+        const targetBase = getTargetDir(options);
+        await fs.mkdir(targetBase, { recursive: true });
+        const installPath = path.join(targetBase, dirName);
+        const stagingPath = path.join(targetBase, `.${dirName}.installing`);
+        // Copy to staging first
+        await fs.cp(skillDir, stagingPath, { recursive: true });
+        // Atomic rename: removes old and puts new in place in one step
+        try {
+            await fs.rename(stagingPath, installPath);
+        }
+        catch {
+            // rename can fail cross-device — fall back to rm + rename
+            await fs.rm(installPath, { recursive: true, force: true });
+            await fs.rename(stagingPath, installPath);
+        }
+        return {
+            skillName,
+            installed: true,
+            installPath,
+            scanPassed: scanResult.passed,
+            report,
+        };
+    }
+    finally {
+        // Always clean up temp dir
+        await fs.rm(tempDir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=skill-installer.js.map

package/dist/skills/skill-installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installer.js","sourceRoot":"","sources":["../../src/skills/skill-installer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,MAAM,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAwB,aAAa,EAAE,MAAM,oBAAoB,CAAC;AA0BzG,gFAAgF;AAEhF,SAAS,YAAY,CAAC,OAAuB;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACtD,CAAC;AAED,2CAA2C;AAC3C,KAAK,UAAU,aAAa,CAAC,WAAmB;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC/D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAqB,EACrB,UAA0B,EAAE;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,yBAAyB;IACzB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IAExE,IAAI,CAAC;QACH,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;QAED,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAEhC,2DAA2D;QAC3D,iEAAiE;QACjE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAEpD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,CAAC,MAAM,+DAA+D,CAC/F,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC;QAE9B,+BAA+B;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,kCAAkC,OAAO,+BAA+B,CAAC,CAAC;QAC5F,CAAC;QAED,sDAAsD;QACtD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,YAAY,IAAI,YAAY,KAAK,OAAO,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,4BAA4B,YAAY,6BAA6B,OAAO,KAAK;gBACjF,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,YAAY,IAAI,OAAO,CAAC;QAE1C,mBAAmB;QACnB,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE;YAC9C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,MAAM;SACvD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAE5C,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC;YACtD,MAAM,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAC7C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,aAAa,CACzD,CAAC,MAAM,CAAC;YACT,OAAO;gBACL,SAAS;gBACT,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,KAAK;gBACjB,MAAM;gBACN,SAAS,EAAE,GAAG,YAAY,2BAA2B,SAAS,qCAAqC;aACpG,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO;gBACL,SAAS;gBACT,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,UAAU,CAAC,MAAM;gBAC7B,MAAM,EAAE,MAAM,GAAG,6CAA6C;aAC/D,CAAC;QACJ,CAAC;QAED,8DAA8D;QAC9D,sFAAsF;QACtF,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,OAAO,aAAa,CAAC,CAAC;QAEpE,wBAAwB;QACxB,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExD,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;YAC1D,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAC5C,CAAC;QAED,OAAO;YACL,SAAS;YACT,SAAS,EAAE,IAAI;YACf,WAAW;YACX,UAAU,EAAE,UAAU,CAAC,MAAM;YAC7B,MAAM;SACP,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,2BAA2B;QAC3B,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC"}

package/dist/skills/skill-scanner.d.ts

@@ -0,0 +1,30 @@
+/**
+ * SkillScanner — Security scanner for .skill / .zip packages before install.
+ *
+ * Scans extracted skill directories using:
+ * - @nodesecure/js-x-ray: AST-based analysis of JS/TS scripts
+ * - Custom checks: SKILL.md allowed-tools validation, shell script patterns,
+ *   hardcoded secrets, curl|bash patterns
+ *
+ * Agent Skills spec: https://agentskills.io/specification
+ */
+export type FindingSeverity = 'critical' | 'high' | 'medium' | 'low' | 'info';
+export interface ScanFinding {
+    severity: FindingSeverity;
+    file: string;
+    line?: number;
+    kind: string;
+    message: string;
+}
+export interface ScanResult {
+    skillName: string;
+    passed: boolean;
+    findings: ScanFinding[];
+    scannedFiles: number;
+}
+export declare const SEVERITY_RANK: Record<FindingSeverity, number>;
+export declare function scanSkillDir(skillDir: string, options?: {
+    severityThreshold?: FindingSeverity;
+}): Promise<ScanResult>;
+export declare function formatScanReport(result: ScanResult): string;
+//# sourceMappingURL=skill-scanner.d.ts.map

package/dist/skills/skill-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-scanner.d.ts","sourceRoot":"","sources":["../../src/skills/skill-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE9E,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;CACtB;AAqDD,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAEzD,CAAC;AA+HF,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,eAAe,CAAA;CAAO,GACpD,OAAO,CAAC,UAAU,CAAC,CA2DrB;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAoB3D"}

package/dist/skills/skill-scanner.js

@@ -0,0 +1,249 @@
+/**
+ * SkillScanner — Security scanner for .skill / .zip packages before install.
+ *
+ * Scans extracted skill directories using:
+ * - @nodesecure/js-x-ray: AST-based analysis of JS/TS scripts
+ * - Custom checks: SKILL.md allowed-tools validation, shell script patterns,
+ *   hardcoded secrets, curl|bash patterns
+ *
+ * Agent Skills spec: https://agentskills.io/specification
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { AstAnalyser } from '@nodesecure/js-x-ray';
+// ─── Severity Maps ──────────────────────────────────────────────────────────
+// js-x-ray warning kind → severity
+const JS_WARNING_SEVERITY = {
+    'obfuscated-code': 'critical',
+    'data-exfiltration': 'critical',
+    'serialize-environment': 'critical',
+    'encoded-literal': 'high',
+    'unsafe-stmt': 'high', // eval, Function()
+    'unsafe-import': 'high',
+    'unsafe-command': 'high',
+    'shady-link': 'medium',
+    'suspicious-literal': 'medium',
+    'suspicious-file': 'medium',
+    'weak-crypto': 'medium',
+    'unsafe-regex': 'low',
+    'short-identifiers': 'low',
+    'synchronous-io': 'info',
+    'parsing-error': 'info',
+};
+// allowed-tools entries that should block install at high severity
+// NOTE: Bash(*) is intentionally excluded here — it has its own critical check below
+// to avoid being downgraded to high by the deduplication step
+const DANGEROUS_TOOL_PATTERNS = [
+    /Bash\(sudo/i,
+    /Bash\(rm\b/i,
+    /Bash\(curl\b/i,
+    /Bash\(wget\b/i,
+    /Bash\(chmod\b/i,
+    /Bash\(chown\b/i,
+];
+// Shell script dangerous patterns (regex → message)
+const SHELL_DANGER_PATTERNS = [
+    { re: /curl\s+[^|]*\|\s*(ba)?sh/i, severity: 'critical', message: 'curl | bash — remote code execution pattern' },
+    { re: /wget\s+[^|]*\|\s*(ba)?sh/i, severity: 'critical', message: 'wget | bash — remote code execution pattern' },
+    { re: /eval\s*\$\(/, severity: 'high', message: 'eval $(...) — dynamic shell execution' },
+    { re: /base64\s+(-d|--decode)/i, severity: 'high', message: 'base64 decode — possible obfuscated payload' },
+    { re: /\/dev\/tcp\//, severity: 'critical', message: '/dev/tcp reverse shell pattern' },
+    { re: /(ANTHROPIC|OPENAI|AWS|GITHUB)_.*KEY/i, severity: 'high', message: 'Possible hardcoded API key or credential' },
+];
+// Hardcoded secret patterns for any file
+const SECRET_PATTERNS = [
+    { re: /sk-[A-Za-z0-9]{20,}/, severity: 'high', message: 'Possible OpenAI/Anthropic API key' },
+    { re: /AKIA[A-Z0-9]{16}/, severity: 'high', message: 'Possible AWS access key' },
+    { re: /ghp_[A-Za-z0-9]{36}/, severity: 'high', message: 'Possible GitHub personal access token' },
+    { re: /xoxb-[A-Za-z0-9\-]+/, severity: 'high', message: 'Possible Slack bot token' },
+];
+export const SEVERITY_RANK = {
+    critical: 4, high: 3, medium: 2, low: 1, info: 0,
+};
+// ─── File Helpers ────────────────────────────────────────────────────────────
+const MAX_WALK_DEPTH = 10;
+async function walkDir(dir, depth = 0) {
+    if (depth > MAX_WALK_DEPTH)
+        return [];
+    const entries = await fs.readdir(dir, { withFileTypes: true });
+    const files = [];
+    for (const e of entries) {
+        const full = path.join(dir, e.name);
+        if (e.isDirectory()) {
+            files.push(...await walkDir(full, depth + 1));
+        }
+        else {
+            files.push(full);
+        }
+    }
+    return files;
+}
+// ─── Individual Scanners ─────────────────────────────────────────────────────
+function scanJsTs(code, relPath) {
+    const analyser = new AstAnalyser();
+    let result;
+    try {
+        result = analyser.analyse(code, { isMinified: false });
+    }
+    catch {
+        return []; // parse error — js-x-ray handles parsing-error in warnings
+    }
+    return result.warnings.map((w) => ({
+        severity: JS_WARNING_SEVERITY[w.kind] ?? 'low',
+        file: relPath,
+        line: extractLine(w.location),
+        kind: String(w.kind),
+        message: `${w.kind}${'value' in w && w.value ? ': ' + String(w.value) : ''}`,
+    }));
+}
+function extractLine(location) {
+    if (!location)
+        return undefined;
+    if (typeof location === 'number')
+        return location;
+    // [[startLine, startCol], [endLine, endCol]]
+    if (Array.isArray(location) && Array.isArray(location[0]))
+        return location[0][0];
+    // [startLine, startCol]
+    if (Array.isArray(location) && typeof location[0] === 'number')
+        return location[0];
+    // { start: { line, column } }
+    if (typeof location === 'object' && 'start' in location) {
+        const start = location.start;
+        if (typeof start === 'number')
+            return start;
+        if (typeof start === 'object' && start !== null && 'line' in start)
+            return start.line;
+    }
+    return undefined;
+}
+function scanShell(code, relPath) {
+    const findings = [];
+    const lines = code.split('\n');
+    for (const { re, severity, message } of SHELL_DANGER_PATTERNS) {
+        for (let i = 0; i < lines.length; i++) {
+            if (re.test(lines[i])) {
+                findings.push({ severity, file: relPath, line: i + 1, kind: 'shell-pattern', message });
+            }
+        }
+    }
+    return findings;
+}
+function scanSecrets(code, relPath) {
+    const findings = [];
+    const lines = code.split('\n');
+    for (const { re, severity, message } of SECRET_PATTERNS) {
+        for (let i = 0; i < lines.length; i++) {
+            if (re.test(lines[i])) {
+                findings.push({ severity, file: relPath, line: i + 1, kind: 'hardcoded-secret', message });
+            }
+        }
+    }
+    return findings;
+}
+function scanAllowedTools(frontmatter, relPath) {
+    const lines = frontmatter.split('\n');
+    const startIdx = lines.findIndex((line) => /allowed-tools\s*:/.test(line));
+    if (startIdx === -1)
+        return [];
+    // Collect the full allowed-tools block including YAML list items on subsequent lines
+    // Stop when we hit the next YAML key (non-indented line that looks like "key:")
+    const toolsLines = [];
+    for (let i = startIdx; i < lines.length; i++) {
+        const line = lines[i];
+        if (i !== startIdx && /^[A-Za-z_-]+\s*:/.test(line))
+            break;
+        toolsLines.push(line);
+    }
+    const toolsBlock = toolsLines.join('\n');
+    const findings = [];
+    // Bash(*) is critical — check first, dedupe key differs from generic high findings
+    if (/Bash\(\*\)/.test(toolsBlock)) {
+        findings.push({
+            severity: 'critical',
+            file: relPath,
+            kind: 'dangerous-allowed-tools-wildcard',
+            message: 'SKILL.md declares Bash(*) — unrestricted shell access',
+        });
+    }
+    // Other dangerous patterns → high
+    for (const pattern of DANGEROUS_TOOL_PATTERNS) {
+        if (pattern.test(toolsBlock)) {
+            findings.push({
+                severity: 'high',
+                file: relPath,
+                kind: 'dangerous-allowed-tools',
+                message: `SKILL.md declares dangerous allowed-tools: ${toolsLines[0].trim()}`,
+            });
+            break; // one high finding per block is enough
+        }
+    }
+    return findings;
+}
+// ─── Main Scanner ────────────────────────────────────────────────────────────
+export async function scanSkillDir(skillDir, options = {}) {
+    const threshold = options.severityThreshold ?? 'high';
+    const thresholdRank = SEVERITY_RANK[threshold];
+    const allFiles = await walkDir(skillDir);
+    const findings = [];
+    let scannedFiles = 0;
+    // Detect skill name from directory
+    const skillName = path.basename(skillDir);
+    for (const absPath of allFiles) {
+        const relPath = path.relative(skillDir, absPath);
+        const ext = path.extname(absPath).toLowerCase();
+        let code;
+        try {
+            code = await fs.readFile(absPath, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        scannedFiles++;
+        // JS/TS AST scan
+        if (['.js', '.mjs', '.cjs', '.ts', '.tsx'].includes(ext)) {
+            findings.push(...scanJsTs(code, relPath));
+        }
+        // Shell script scan
+        if (['.sh', '.bash', '.zsh'].includes(ext) || relPath.startsWith('scripts/')) {
+            findings.push(...scanShell(code, relPath));
+        }
+        // SKILL.md — validate frontmatter + allowed-tools
+        if (path.basename(absPath) === 'SKILL.md') {
+            const frontmatterMatch = code.match(/^---\n([\s\S]*?)\n---/);
+            if (frontmatterMatch) {
+                findings.push(...scanAllowedTools(frontmatterMatch[1], relPath));
+            }
+        }
+        // Secret scan on all text files
+        if (['.js', '.mjs', '.cjs', '.ts', '.tsx', '.sh', '.bash', '.py', '.md', '.env', '.toml', '.yaml', '.yml'].includes(ext)) {
+            findings.push(...scanSecrets(code, relPath));
+        }
+    }
+    // Deduplicate exact duplicates
+    const unique = findings.filter((f, i, arr) => arr.findIndex((x) => x.file === f.file && x.line === f.line && x.kind === f.kind) === i);
+    // Sort by severity desc
+    unique.sort((a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity]);
+    const passed = !unique.some((f) => SEVERITY_RANK[f.severity] >= thresholdRank);
+    return { skillName, passed, findings: unique, scannedFiles };
+}
+export function formatScanReport(result) {
+    const icon = {
+        critical: '🔴', high: '🟠', medium: '🟡', low: '🔵', info: '⚪',
+    };
+    const lines = [
+        `\nScan: ${result.skillName} (${result.scannedFiles} files)`,
+        result.passed ? '✅ Passed' : '❌ Blocked — findings above threshold',
+    ];
+    if (result.findings.length === 0) {
+        lines.push('  No findings.');
+    }
+    else {
+        for (const f of result.findings) {
+            const loc = f.line ? `:${f.line}` : '';
+            lines.push(`  ${icon[f.severity]} [${f.severity.toUpperCase()}] ${f.file}${loc} — ${f.message}`);
+        }
+    }
+    return lines.join('\n');
+}
+//# sourceMappingURL=skill-scanner.js.map

package/dist/skills/skill-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-scanner.js","sourceRoot":"","sources":["../../src/skills/skill-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAqBnD,+EAA+E;AAE/E,mCAAmC;AACnC,MAAM,mBAAmB,GAAoC;IAC3D,iBAAiB,EAAO,UAAU;IAClC,mBAAmB,EAAK,UAAU;IAClC,uBAAuB,EAAC,UAAU;IAClC,iBAAiB,EAAO,MAAM;IAC9B,aAAa,EAAW,MAAM,EAAK,mBAAmB;IACtD,eAAe,EAAS,MAAM;IAC9B,gBAAgB,EAAQ,MAAM;IAC9B,YAAY,EAAY,QAAQ;IAChC,oBAAoB,EAAI,QAAQ;IAChC,iBAAiB,EAAO,QAAQ;IAChC,aAAa,EAAW,QAAQ;IAChC,cAAc,EAAU,KAAK;IAC7B,mBAAmB,EAAK,KAAK;IAC7B,gBAAgB,EAAQ,MAAM;IAC9B,eAAe,EAAS,MAAM;CAC/B,CAAC;AAEF,mEAAmE;AACnE,qFAAqF;AACrF,8DAA8D;AAC9D,MAAM,uBAAuB,GAAG;IAC9B,aAAa;IACb,aAAa;IACb,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,gBAAgB;CACjB,CAAC;AAEF,oDAAoD;AACpD,MAAM,qBAAqB,GAAsE;IAC/F,EAAE,EAAE,EAAE,2BAA2B,EAAO,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,6CAA6C,EAAE;IACtH,EAAE,EAAE,EAAE,2BAA2B,EAAO,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,6CAA6C,EAAE;IACtH,EAAE,EAAE,EAAE,aAAa,EAAsB,QAAQ,EAAE,MAAM,EAAM,OAAO,EAAE,uCAAuC,EAAE;IACjH,EAAE,EAAE,EAAE,yBAAyB,EAAU,QAAQ,EAAE,MAAM,EAAM,OAAO,EAAE,6CAA6C,EAAE;IACvH,EAAE,EAAE,EAAE,cAAc,EAAqB,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,gCAAgC,EAAE;IAC1G,EAAE,EAAE,EAAE,sCAAsC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,0CAA0C,EAAE;CACtH,CAAC;AAEF,yCAAyC;AACzC,MAAM,eAAe,GAAsE;IACzF,EAAE,EAAE,EAAE,qBAAqB,EAAa,QAAQ,EAAE,MAAM,EAAM,OAAO,EAAE,mCAAmC,EAAE;IAC5G,EAAE,EAAE,EAAE,kBAAkB,EAAgB,QAAQ,EAAE,MAAM,EAAM,OAAO,EAAE,yBAAyB,EAAE;IAClG,EAAE,EAAE,EAAE,qBAAqB,EAAa,QAAQ,EAAE,MAAM,EAAM,OAAO,EAAE,uCAAuC,EAAE;IAChH,EAAE,EAAE,EAAE,qBAAqB,EAAY,QAAQ,EAAE,MAAM,EAAM,OAAO,EAAE,0BAA0B,EAAE;CACnG,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAoC;IAC5D,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;CACjD,CAAC;AAEF,gFAAgF;AAEhF,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,KAAK,GAAG,CAAC;IAC3C,IAAI,KAAK,GAAG,cAAc;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAEhF,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAe;IAC7C,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,2DAA2D;IACxE,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC,IAAc,CAAC,IAAI,KAAK;QACxD,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACpB,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE;KAC7E,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,WAAW,CAAC,QAAiB;IACpC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAClD,6CAA6C;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC;IAC3F,wBAAwB;IACxB,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAW,CAAC;IAC7F,8BAA8B;IAC9B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxD,MAAM,KAAK,GAAI,QAA+B,CAAC,KAAK,CAAC;QACrD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;YAAE,OAAQ,KAA0B,CAAC,IAAI,CAAC;IAC9G,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe;IAC9C,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,qBAAqB,EAAE,CAAC;QAC9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,OAAe;IAChD,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,eAAe,EAAE,CAAC;QACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAmB,EAAE,OAAe;IAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAE/B,qFAAqF;IACrF,gFAAgF;IAChF,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,CAAC,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM;QAC3D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,mFAAmF;IACnF,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,UAAU;YACpB,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,kCAAkC;YACxC,OAAO,EAAE,uDAAuD;SACjE,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,8CAA8C,UAAU,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,EAAE;aAC/E,CAAC,CAAC;YACH,MAAM,CAAC,uCAAuC;QAChD,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,UAAmD,EAAE;IAErD,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,IAAI,MAAM,CAAC;IACtD,MAAM,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAE/C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,mCAAmC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,IAAI,IAAY,CAAC;QAEjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,YAAY,EAAE,CAAC;QAEf,iBAAiB;QACjB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,oBAAoB;QACpB,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7E,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,kDAAkD;QAClD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;YAC1C,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC7D,IAAI,gBAAgB,EAAE,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAE,EAAE,OAAO,CAAC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzH,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,+BAA+B;IAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAC3C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CACxF,CAAC;IAEF,wBAAwB;IACxB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE7E,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,CAAC;IAE/E,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IACjD,MAAM,IAAI,GAAoC;QAC5C,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG;KAC/D,CAAC;IAEF,MAAM,KAAK,GAAa;QACtB,WAAW,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,YAAY,SAAS;QAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,sCAAsC;KACpE,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/tools/index.d.ts

@@ -7,4 +7,6 @@
 export * from './notifications.js';
 export * from './memory-tools.js';
 export * from './tool-factory.js';
+export * from './planning-tool.js';
+export * from './subagent-tool.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC"}

package/dist/tools/index.js

@@ -7,4 +7,6 @@
 export * from './notifications.js';
 export * from './memory-tools.js';
 export * from './tool-factory.js';
+export * from './planning-tool.js';
+export * from './subagent-tool.js';
 //# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC"}