super-skill-cli 0.9.2__tar.gz → 0.11.0__tar.gz

{super_skill_cli-0.9.2 → super_skill_cli-0.11.0}/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "super-skill: personal Agent-Skill package manager (versioned registry, rollback, mining).",
-    "version": "0.9.2"
+    "version": "0.11.0"
   },
   "plugins": [
     {
       "name": "super-skill",
       "source": "./",
       "description": "Git-backed versioned registry for your Claude Code skills: seed import, explain/provenance, one-command rollback, integrity doctor, and opportunity mining. Wraps the `super-skill` CLI (pip/uv installable as super-skill-cli).",
-      "version": "0.9.2",
+      "version": "0.11.0",
       "category": "development"
     }
   ]

{super_skill_cli-0.9.2 → super_skill_cli-0.11.0}/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "super-skill",
-  "version": "0.9.2",
+  "version": "0.11.0",
   "description": "Personal Agent-Skill package manager: a git-backed, versioned registry for your Claude Code skills with seed import, provenance/explain, one-command rollback, integrity doctor, and opportunity mining from captured sessions.",
   "author": {
     "name": "sdsrss",

{super_skill_cli-0.9.2 → super_skill_cli-0.11.0}/CHANGELOG.md

@@ -3,6 +3,85 @@
 All notable changes to this project are documented here. Format follows
 [Keep a Changelog](https://keepachangelog.com/); this project uses semantic versioning.
 
+## [0.11.0] - 2026-07-12
+
+Security & reliability hardening from a full production-readiness audit. All fixes
+are backward-compatible; defaults unchanged. **Recommended upgrade** if you wire
+live capture via `hooks-config` — the capture/redaction path had secret-leak and
+crash-safety gaps that this release closes.
+
+**Migration**: none required. An existing `mine_state.json` from 0.10.0 is auto-
+handled (the watermark format changed to a session-id set; an old file reads as
+"nothing mined" and self-heals on the next `mine`). **Revert path**: pin the prior
+release with `pip install super-skill-cli==0.10.0`.
+
+### Security
+- **Redaction no longer leaks underscore-delimited env-var secrets** — `DB_PASSWORD=…`,
+  `AWS_SECRET_ACCESS_KEY=…`, `SECRET_KEY=…` etc. were written verbatim to the WAL
+  because the keyword rule anchored on `\b` (an underscore is a word char). The
+  same `redact_text` feeds the eval-lite secret gate, so this closed a leak in
+  both paths at once.
+- **Redaction now matches current key formats** — OpenAI `sk-proj-`/`sk-svcacct-`,
+  Stripe `sk_live_`/`sk_test_`, GitHub fine-grained PATs `github_pat_`, and GCP
+  `AIza…` keys were previously unmatched.
+- **The instruction-layer gate + eval-lite scan the full frontmatter**, not just
+  `description` + body — an injection or secret in any other frontmatter field
+  (e.g. `instructions:`, `metadata:`) previously shipped to the host unscanned.
+- **The gate normalizes cheap obfuscation** (NFKC + zero-width strip + common
+  Cyrillic/Greek homoglyph fold) so `с​url … | bash` and homoglyph variants no
+  longer slip a shell pipe past the ASCII rules.
+- **The capture WAL and mine watermark are gitignored** — `events/` and
+  `mine_state.json` are no longer swept into the registry's audit history by
+  `git add -A`, keeping (redacted-but-private) session content out of the repo.
+- **Redaction depth is capped** so a pathologically nested payload can't
+  `RecursionError`; the over-deep subtree is dropped rather than leaked.
+
+### Fixed
+- **`capture` never fails the host session (NFR-3)** — non-object JSON on stdin
+  and any WAL write error are now swallowed with exit 0; previously a list/scalar
+  payload raised and exited 1.
+- **The WAL tolerates a torn/partial line** — a hook killed mid-append no longer
+  bricks every reader (`status`/`mine`/`count`); the bad line is skipped.
+- **Concurrent captures no longer corrupt the WAL** — each event is one atomic
+  `O_APPEND` write instead of a buffered write that could interleave across
+  processes.
+- **Registry/candidate/watermark writes are atomic** (temp + `os.replace`), and a
+  corrupt `meta.json`/`candidate.json` surfaces as a typed error instead of a raw
+  traceback that crashed `status`/`list`/`doctor`.
+- **`approve` is crash-idempotent** — a crash between the registry commit and
+  marking the candidate approved no longer double-promotes on re-run.
+- **`seed` skips a skill whose frontmatter `name` ≠ its directory name**, so two
+  host dirs sharing a name can no longer collapse into one version chain.
+- **The `mine` reminder survives WAL TTL pruning** — the watermark tracks mined
+  session ids, so new sessions still count as "unmined" after old ones roll off.
+- **`init` rebuilds a missing/stale `.gitignore`** even when `.git` already exists.
+
+### Changed
+- Docs `02`/`03`/`04` bumped to v1.4 with WS-vs-target implementation notes
+  (registry-as-source distribution, WS entity/eval-lite subsets) for doc↔code
+  consistency. Test suite grew 127 → 159; `gate.py` and `redact.py` at 100%
+  line coverage.
+
+## [0.10.0] - 2026-07-12
+
+### Added
+- **Codex Target Adapter** (docs/01 FR-PUB-2) — the CLI now distributes to more
+  than one host. `seed`, `approve`, `rollback`, and a new `materialize` command
+  take `--host claude | codex | all`; `codex` reads/writes `~/.agents/skills`
+  (override with `SUPER_SKILL_CODEX_SKILLS`), `all` targets both hosts. Defaults
+  stay `claude`, so existing behavior is unchanged.
+- **`materialize [skill_id] --host …`** — explicitly (re)distribute one skill, or
+  all active skills, to Claude Code and/or Codex.
+- **`codex/agents/openai.yaml`** — an optional Codex host-extension shipped with
+  the meta-skill (`interface` display name + `policy.allow_implicit_invocation`),
+  installed alongside `SKILL.md` by `codex/install.sh`. Schema per the Codex
+  build-skills docs; kept to the fields super-skill needs.
+
+### Notes
+- Self-learning (M1–M5) remains gated off by the H1 falsification GATE — not
+  built. The Codex adapter here is packaging/distribution (FR-PUB-2), not the
+  self-learning track.
+
 ## [0.9.2] - 2026-07-12
 
 ### Changed

{super_skill_cli-0.9.2 → super_skill_cli-0.11.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: super-skill-cli
-Version: 0.9.2
+Version: 0.11.0
 Summary: Personal Agent-Skill package manager: versioned registry, seed import, explain, rollback (M0+WS scope).
 Project-URL: Homepage, https://github.com/sdsrss/super-skill
 Project-URL: Repository, https://github.com/sdsrss/super-skill
@@ -93,8 +93,9 @@ pipx install super-skill-cli
 codex/install.sh                     # drops the meta-skill into ~/.agents/skills
 ```
 
-Point the CLI at the Codex directory with `SUPER_SKILL_HOST_SKILLS=~/.agents/skills`.
-See [`codex/README.md`](codex/README.md).
+The CLI speaks Codex natively via `--host codex` — `super-skill seed --host codex`,
+`super-skill materialize --host codex` (or `--host all` for both hosts). See
+[`codex/README.md`](codex/README.md).
 
 ## Features
 
@@ -104,7 +105,8 @@ See [`codex/README.md`](codex/README.md).
 | `status` / `list` | Registry summary (skills, versions, events, candidates) and the skill list. |
 | `show <id>` | Frontmatter, version history, and content hashes for one skill. |
 | `explain <id>` | Provenance chain + audit trail + the exact rollback command. |
-| `rollback <id> [--to vN]` | Switch the active version and re-materialize it to the host. |
+| `rollback <id> [--to vN]` | Switch the active version and re-materialize it to the host(s). |
+| `materialize [id] --host claude\|codex\|all` | Distribute active skill(s) to Claude Code and/or Codex (the Codex Target Adapter). |
 | `doctor` / `doctor --fix` | Integrity check (hashes, active pointer, host sync); `--fix` restores git-recoverable versions and re-materializes drift, then re-verifies. |
 | `capture` | Append a host event to the redacted WAL — reads hook JSON on stdin, never fails the session. |
 | `mine` | Surface task families recurring across ≥3 distinct sessions; nudges you once enough new sessions accumulate. |
@@ -161,7 +163,8 @@ super-skill candidate approve <id>
 | Env var | Default | Purpose |
 |---|---|---|
 | `SUPER_SKILL_HOME` | `~/.super-skill` | Registry + control state (a git repo). |
-| `SUPER_SKILL_HOST_SKILLS` | `~/.claude/skills` | Skills directory to seed/materialize (set to `~/.agents/skills` for Codex). |
+| `SUPER_SKILL_HOST_SKILLS` | `~/.claude/skills` | Claude Code skills directory (`--host claude`). |
+| `SUPER_SKILL_CODEX_SKILLS` | `~/.agents/skills` | Codex skills directory (`--host codex`). |
 | `SUPER_SKILL_MINE_REMINDER` | `3` | Distinct unmined sessions before `status` nudges you to mine. |
 
 ## Scope
@@ -189,13 +192,14 @@ Redaction runs *before* any write: secret values and private paths never reach t
 log. Capture is off until you wire it (`super-skill hooks-config`).
 
 **Do I need PyPI for the plugin to work?**
-The plugin calls the `super-skill` CLI on your PATH. Until the PyPI release,
-install the CLI from source: `uv tool install git+https://github.com/sdsrss/super-skill`.
+The plugin calls the `super-skill` CLI on your PATH. Install it from PyPI:
+`uv tool install super-skill-cli` (or `pipx install super-skill-cli`).
 
 **Does it support Codex?**
-Yes — the same CLI plus a `codex/` install package for `~/.agents/skills`. A Codex
-*Target Adapter inside the CLI* is a later item; distributing skills to Codex needs
-no extra step since they already live in `~/.agents/skills`.
+Yes — the same CLI plus a `codex/` install package for `~/.agents/skills`. The CLI
+has a Codex Target Adapter: `--host codex` (and `--host all`) on `seed`, `approve`,
+`rollback`, and `materialize` reads from and writes to Codex's `~/.agents/skills`.
+The Codex package also ships an optional `agents/openai.yaml` host extension.
 
 ## Develop
 

{super_skill_cli-0.9.2 → super_skill_cli-0.11.0}/README.md

@@ -72,8 +72,9 @@ pipx install super-skill-cli
 codex/install.sh                     # drops the meta-skill into ~/.agents/skills
 ```
 
-Point the CLI at the Codex directory with `SUPER_SKILL_HOST_SKILLS=~/.agents/skills`.
-See [`codex/README.md`](codex/README.md).
+The CLI speaks Codex natively via `--host codex` — `super-skill seed --host codex`,
+`super-skill materialize --host codex` (or `--host all` for both hosts). See
+[`codex/README.md`](codex/README.md).
 
 ## Features
 
@@ -83,7 +84,8 @@ See [`codex/README.md`](codex/README.md).
 | `status` / `list` | Registry summary (skills, versions, events, candidates) and the skill list. |
 | `show <id>` | Frontmatter, version history, and content hashes for one skill. |
 | `explain <id>` | Provenance chain + audit trail + the exact rollback command. |
-| `rollback <id> [--to vN]` | Switch the active version and re-materialize it to the host. |
+| `rollback <id> [--to vN]` | Switch the active version and re-materialize it to the host(s). |
+| `materialize [id] --host claude\|codex\|all` | Distribute active skill(s) to Claude Code and/or Codex (the Codex Target Adapter). |
 | `doctor` / `doctor --fix` | Integrity check (hashes, active pointer, host sync); `--fix` restores git-recoverable versions and re-materializes drift, then re-verifies. |
 | `capture` | Append a host event to the redacted WAL — reads hook JSON on stdin, never fails the session. |
 | `mine` | Surface task families recurring across ≥3 distinct sessions; nudges you once enough new sessions accumulate. |
@@ -140,7 +142,8 @@ super-skill candidate approve <id>
 | Env var | Default | Purpose |
 |---|---|---|
 | `SUPER_SKILL_HOME` | `~/.super-skill` | Registry + control state (a git repo). |
-| `SUPER_SKILL_HOST_SKILLS` | `~/.claude/skills` | Skills directory to seed/materialize (set to `~/.agents/skills` for Codex). |
+| `SUPER_SKILL_HOST_SKILLS` | `~/.claude/skills` | Claude Code skills directory (`--host claude`). |
+| `SUPER_SKILL_CODEX_SKILLS` | `~/.agents/skills` | Codex skills directory (`--host codex`). |
 | `SUPER_SKILL_MINE_REMINDER` | `3` | Distinct unmined sessions before `status` nudges you to mine. |
 
 ## Scope
@@ -168,13 +171,14 @@ Redaction runs *before* any write: secret values and private paths never reach t
 log. Capture is off until you wire it (`super-skill hooks-config`).
 
 **Do I need PyPI for the plugin to work?**
-The plugin calls the `super-skill` CLI on your PATH. Until the PyPI release,
-install the CLI from source: `uv tool install git+https://github.com/sdsrss/super-skill`.
+The plugin calls the `super-skill` CLI on your PATH. Install it from PyPI:
+`uv tool install super-skill-cli` (or `pipx install super-skill-cli`).
 
 **Does it support Codex?**
-Yes — the same CLI plus a `codex/` install package for `~/.agents/skills`. A Codex
-*Target Adapter inside the CLI* is a later item; distributing skills to Codex needs
-no extra step since they already live in `~/.agents/skills`.
+Yes — the same CLI plus a `codex/` install package for `~/.agents/skills`. The CLI
+has a Codex Target Adapter: `--host codex` (and `--host all`) on `seed`, `approve`,
+`rollback`, and `materialize` reads from and writes to Codex's `~/.agents/skills`.
+The Codex package also ships an optional `agents/openai.yaml` host extension.
 
 ## Develop
 

{super_skill_cli-0.9.2 → super_skill_cli-0.11.0}/README.zh-CN.md

@@ -59,7 +59,8 @@ pipx install super-skill-cli
 codex/install.sh                     # 把元技能装进 ~/.agents/skills
 ```
 
-用 `SUPER_SKILL_HOST_SKILLS=~/.agents/skills` 让 CLI 指向 Codex 目录。详见
+CLI 原生支持 Codex——`--host codex`:`super-skill seed --host codex`、
+`super-skill materialize --host codex`(或 `--host all` 同时分发两个宿主)。详见
 [`codex/README.md`](codex/README.md)。
 
 ## 功能
@@ -71,6 +72,7 @@ codex/install.sh                     # 把元技能装进 ~/.agents/skills
 | `show <id>` | 某技能的 frontmatter、版本历史与内容哈希。 |
 | `explain <id>` | 来源链 + 审计记录 + 精确回滚命令。 |
 | `rollback <id> [--to vN]` | 切换活动版本并重新落地到宿主。 |
+| `materialize [id] --host claude\|codex\|all` | 把活动技能分发到 Claude Code 与/或 Codex(Codex Target Adapter)。 |
 | `doctor` / `doctor --fix` | 完整性校验(哈希、活动指针、宿主同步);`--fix` 从 git 恢复版本、重落地漂移,再复验。 |
 | `capture` | 把一条宿主事件追加进脱敏 WAL——从 stdin 读 hook JSON,绝不让会话失败。 |
 | `mine` | 挖掘跨 ≥3 个去重会话复现的任务家族;攒够新会话时提醒你挖掘。 |
@@ -124,7 +126,8 @@ super-skill candidate approve <id>
 | 环境变量 | 默认 | 用途 |
 |---|---|---|
 | `SUPER_SKILL_HOME` | `~/.super-skill` | 注册表 + 控制状态(git 仓库)。 |
-| `SUPER_SKILL_HOST_SKILLS` | `~/.claude/skills` | 要 seed/落地的技能目录(Codex 设为 `~/.agents/skills`)。 |
+| `SUPER_SKILL_HOST_SKILLS` | `~/.claude/skills` | Claude Code 技能目录(`--host claude`)。 |
+| `SUPER_SKILL_CODEX_SKILLS` | `~/.agents/skills` | Codex 技能目录(`--host codex`)。 |
 | `SUPER_SKILL_MINE_REMINDER` | `3` | `status` 提醒挖掘前的去重未挖掘会话数阈值。 |
 
 ## 范围
@@ -146,12 +149,13 @@ super-skill 刻意停在**包管理器**形态(里程碑 M0 + WS)。自学习闭
 脱敏在*任何写入之前*运行:密钥值与私有路径永不进日志。捕获默认关闭,需你接线(`super-skill hooks-config`)。
 
 **插件必须依赖 PyPI 才能用吗?**
-插件调用 PATH 上的 `super-skill` CLI。PyPI 发布前,从源码装 CLI:
-`uv tool install git+https://github.com/sdsrss/super-skill`。
+插件调用 PATH 上的 `super-skill` CLI。从 PyPI 安装:
+`uv tool install super-skill-cli`(或 `pipx install super-skill-cli`)。
 
 **支持 Codex 吗?**
-支持——同一个 CLI 加一个面向 `~/.agents/skills` 的 `codex/` 安装包。CLI *内部的* Codex Target
-Adapter 是后续项;把技能分发给 Codex 无需额外步骤,因为它们本就在 `~/.agents/skills`。
+支持——同一个 CLI 加一个面向 `~/.agents/skills` 的 `codex/` 安装包。CLI 已内置 Codex Target
+Adapter:`seed`、`approve`、`rollback`、`materialize` 的 `--host codex`(及 `--host all`)会从
+Codex 的 `~/.agents/skills` 读取并写入。Codex 包还附带一个可选的 `agents/openai.yaml` 宿主扩展。
 
 ## 开发
 

super_skill_cli-0.11.0/codex/README.md

@@ -0,0 +1,43 @@
+# super-skill for Codex
+
+Codex adopted the [Agent Skills](https://agentskills.io) open standard: it reads
+`SKILL.md` from `~/.agents/skills` (user-level) and `.agents/skills` (repo-level).
+There is no marketplace/plugin install like Claude Code — a skill is just its
+`SKILL.md` placed in the skills directory. This package is that skill plus a
+one-line installer.
+
+## Install
+
+```bash
+# 1. Install the host-agnostic CLI (the command stays `super-skill`)
+pipx install super-skill-cli          # or: uv tool install super-skill-cli
+
+# 2. Install the meta-skill into ~/.agents/skills (idempotent)
+codex/install.sh
+```
+
+`install.sh` copies `skills/super-skill/SKILL.md` into
+`~/.agents/skills/super-skill/`. Re-running it is safe.
+
+## Use
+
+super-skill manages the skills in your skills directory (version, explain,
+rollback, integrity `doctor`, opportunity `mine`). The CLI has a **Codex Target
+Adapter** — use `--host codex` (or `--host all`) to read from and write to Codex's
+`~/.agents/skills`:
+
+```bash
+super-skill seed --host codex                 # import from ~/.agents/skills (read-only)
+super-skill materialize --host codex          # distribute active skills to Codex
+super-skill materialize <id> --host all       # push one skill to both hosts
+```
+
+`~/.agents/skills` is super-skill's canonical Codex source — Codex reads promoted
+skills there directly (zero-copy). Override the path with `SUPER_SKILL_CODEX_SKILLS`.
+
+## `agents/openai.yaml`
+
+This package ships an optional `agents/openai.yaml` host extension (installed
+alongside `SKILL.md`) with Codex UI + invocation-policy hints (`interface`,
+`policy`). Only the open-standard `SKILL.md` is required; edit or remove the YAML
+per your current Codex version's docs.

{super_skill_cli-0.9.2 → super_skill_cli-0.11.0}/codex/install.sh

@@ -14,8 +14,9 @@ if [ ! -f "${SRC}/SKILL.md" ]; then
 fi
 
 mkdir -p "${DEST}"
-cp "${SRC}/SKILL.md" "${DEST}/SKILL.md"
-echo "installed super-skill meta-skill -> ${DEST}/SKILL.md"
+# Copy the whole skill tree: SKILL.md + optional agents/openai.yaml (host extension).
+cp -R "${SRC}/." "${DEST}/"
+echo "installed super-skill meta-skill -> ${DEST}/ (SKILL.md + agents/openai.yaml)"
 
 if ! command -v super-skill >/dev/null 2>&1; then
   echo "note: the 'super-skill' CLI is not on PATH — install it with:" >&2

super_skill_cli-0.11.0/codex/skills/super-skill/agents/openai.yaml

@@ -0,0 +1,12 @@
+# Codex host-extension metadata (OPTIONAL). Only SKILL.md is required; this file
+# adds Codex-specific UI + invocation hints. Schema per the Codex build-skills
+# docs (learn.chatgpt.com/docs/build-skills): interface / policy / dependencies.
+# Kept to the fields super-skill actually needs — a CLI-driven manager, not an
+# MCP tool, so no dependencies block.
+interface:
+  display_name: super-skill
+  short_description: Version, roll back, and audit your Agent Skills.
+policy:
+  # true = Codex may auto-select this skill from the user's prompt;
+  # false would require an explicit $super-skill invocation.
+  allow_implicit_invocation: true

{super_skill_cli-0.9.2 → super_skill_cli-0.11.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "super-skill-cli"
-version = "0.9.2"
+version = "0.11.0"
 description = "Personal Agent-Skill package manager: versioned registry, seed import, explain, rollback (M0+WS scope)."
 readme = "README.md"
 requires-python = ">=3.12"

{super_skill_cli-0.9.2 → super_skill_cli-0.11.0}/super_skill/candidate.py

@@ -10,11 +10,12 @@ candidate -> gate (human approve) -> promote, never bypassed.
 
 from __future__ import annotations
 
+import os
 import re
 from datetime import datetime
 from pathlib import Path
 
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import BaseModel, ConfigDict, Field, ValidationError
 
 from . import config
 from .evallite import EvalError, eval_lite
@@ -95,7 +96,10 @@ class CandidateStore:
         meta = self._cdir(cand_id) / "candidate.json"
         if not meta.exists():
             return None
-        return Candidate.model_validate_json(meta.read_text(encoding="utf-8"))
+        try:
+            return Candidate.model_validate_json(meta.read_text(encoding="utf-8"))
+        except ValidationError as e:
+            raise CandidateError(f"{cand_id}: corrupt candidate.json ({e})") from e
 
     def list(self) -> list[Candidate]:
         if not self.dir.exists():
@@ -116,9 +120,11 @@ class CandidateStore:
     def save(self, cand: Candidate) -> None:
         cdir = self._cdir(cand.candidate_id)
         cdir.mkdir(parents=True, exist_ok=True)
-        (cdir / "candidate.json").write_text(
-            cand.model_dump_json(indent=2), encoding="utf-8"
-        )
+        # Atomic write so a crash can't leave a truncated candidate.json (M12).
+        p = cdir / "candidate.json"
+        tmp = p.with_suffix(".json.tmp")
+        tmp.write_text(cand.model_dump_json(indent=2), encoding="utf-8")
+        os.replace(tmp, p)
 
 
 def draft_from_families(

{super_skill_cli-0.9.2 → super_skill_cli-0.11.0}/super_skill/capture.py

@@ -7,10 +7,13 @@ events are TTL-bounded (FR-CAP-6); structured products live elsewhere.
 
 from __future__ import annotations
 
+import os
 import uuid
 from collections.abc import Iterator
 from pathlib import Path
 
+from pydantic import ValidationError
+
 from . import config
 from .redact import redact_payload, redact_text
 from .schemas import CaptureEvent, EventType
@@ -53,8 +56,15 @@ class EventLog:
         day = event.timestamp.strftime("%Y-%m-%d")
         out = self.events_dir / day / "events.jsonl"
         out.parent.mkdir(parents=True, exist_ok=True)
-        with out.open("a", encoding="utf-8") as f:
-            f.write(event.model_dump_json() + "\n")
+        # One atomic append per event: a single O_APPEND os.write, not a buffered
+        # writer that can split a large line into multiple write() calls and let
+        # two concurrent captures interleave into a corrupt line (H4).
+        data = (event.model_dump_json() + "\n").encode("utf-8")
+        fd = os.open(out, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o644)
+        try:
+            os.write(fd, data)
+        finally:
+            os.close(fd)
         return event
 
     def iter_events(self) -> Iterator[CaptureEvent]:
@@ -66,11 +76,20 @@ class EventLog:
                 continue
             for line in wal.read_text(encoding="utf-8").splitlines():
                 line = line.strip()
-                if line:
+                if not line:
+                    continue
+                try:
                     yield CaptureEvent.model_validate_json(line)
+                except ValidationError:
+                    # A killed hook can leave a torn final line; one bad record
+                    # must not brick every reader (status/mine/count). Skip it.
+                    continue
 
     def count(self) -> int:
         return sum(1 for _ in self.iter_events())
 
+    def session_ids(self) -> set[str]:
+        return {ev.session_id for ev in self.iter_events()}
+
     def distinct_sessions(self) -> int:
-        return len({ev.session_id for ev in self.iter_events()})
+        return len(self.session_ids())

{super_skill_cli-0.9.2 → super_skill_cli-0.11.0}/super_skill/cli.py

@@ -37,19 +37,54 @@ def _short(text: str, n: int = 60) -> str:
 
 
 @app.command()
-def seed() -> None:
+def seed(host: str = typer.Option("claude", "--host", help="source host: claude | codex")) -> None:
     """Import existing host skills into the registry (idempotent, read-only on host)."""
+    if host not in config.HOSTS:
+        typer.echo(f"unknown host {host!r} (expected: {', '.join(config.HOSTS)})", err=True)
+        raise typer.Exit(1)
     reg = _registry()
-    report = seed_from_host(reg, config.host_skills_dir())
+    src = config.host_skills_dir(host)
+    report = seed_from_host(reg, src)
     typer.echo(
         f"seed: {len(report.imported)} imported, {len(report.updated)} updated, "
         f"{len(report.unchanged)} unchanged, {len(report.skipped)} skipped "
-        f"(host={config.host_skills_dir()})"
+        f"(host={src})"
     )
     for name, reason in report.skipped:
         typer.echo(f"  skipped {name}: {reason}")
 
 
+@app.command()
+def materialize(
+    skill_id: str = typer.Argument("", help="skill to distribute; empty = all active skills"),
+    host: str = typer.Option("claude", "--host", help="target host: claude | codex | all"),
+) -> None:
+    """Distribute active skill(s) to a host skills dir — Claude Code and/or Codex (FR-PUB-2)."""
+    reg = _registry()
+    try:
+        hosts = config.resolve_hosts(host)
+    except ValueError as e:
+        typer.echo(str(e), err=True)
+        raise typer.Exit(1) from e
+    ids = [skill_id] if skill_id else [
+        r.skill.skill_id for r in reg.list_skills() if r.skill.active_version
+    ]
+    if not ids:
+        typer.echo("no active skills to materialize")
+        return
+    failed = False
+    for sid in ids:
+        for h in hosts:
+            try:
+                dest = reg.materialize(sid, config.host_skills_dir(h))
+                typer.echo(f"{sid} -> {h}: {dest}")
+            except RegistryError as e:
+                typer.echo(f"{sid} -> {h}: {e}", err=True)
+                failed = True
+    if failed:
+        raise typer.Exit(1)
+
+
 @app.command()
 def capture(
     event_type: str = typer.Option("", "--event-type", help="override hook_event_name"),
@@ -64,35 +99,43 @@ def capture(
         data = json.loads(raw) if raw.strip() else {}
     except (json.JSONDecodeError, OSError):
         raise typer.Exit(0) from None
-    name = event_type or str(data.get("hook_event_name", ""))
+    # NFR-3: the hook must NEVER fail the host session. Everything past here —
+    # non-dict JSON (data.get would raise), an unknown event type, or any WAL
+    # write error — is swallowed and exits 0. Capture-never-fails beats
+    # capture-complete.
     try:
-        etype = EventType(name)
-    except ValueError:
+        if not isinstance(data, dict):
+            raise typer.Exit(0)
+        name = event_type or str(data.get("hook_event_name", ""))
+        etype = EventType(name)  # ValueError on unknown type
+        session_id = str(data.get("session_id", "unknown"))
+        project_id = data.get("cwd")
+        EventLog().append(
+            etype, session_id, data, project_id=str(project_id) if project_id else None
+        )
+    except typer.Exit:
+        raise
+    except Exception:
         raise typer.Exit(0) from None
-    session_id = str(data.get("session_id", "unknown"))
-    project_id = data.get("cwd")
-    EventLog().append(
-        etype, session_id, data, project_id=str(project_id) if project_id else None
-    )
 
 
 @app.command()
 def mine(min_sessions: int = typer.Option(3, "--min-sessions")) -> None:
     """Surface recurring task families from captured events (FR-GEN-1 signal)."""
     log = EventLog()
+    session_ids = log.session_ids()
     families = mine_families(log.iter_events(), min_sessions=min_sessions)
-    distinct = log.distinct_sessions()
     if not families:
         typer.echo(
             f"no families recurring across >={min_sessions} sessions yet "
-            f"({distinct} distinct sessions captured)"
+            f"({len(session_ids)} distinct sessions captured)"
         )
     else:
         typer.echo(f"{'sessions':>8}  {'events':>6}  family")
         for fam in families:
             typer.echo(f"{fam.session_count:>8}  {fam.event_count:>6}  {fam.label}")
     # Mining acknowledges the accumulated sessions: reset the reminder watermark.
-    minestate.record_mined(log.root, distinct)
+    minestate.record_mined(log.root, session_ids)
 
 
 @app.command()
@@ -114,7 +157,7 @@ def status() -> None:
     log = EventLog(reg.root)
     typer.echo(f"events     : {log.count()}")
     typer.echo(f"candidates : {len(cands)} ({breakdown})")
-    unmined = minestate.unmined(reg.root, log.distinct_sessions())
+    unmined = minestate.unmined(reg.root, log.session_ids())
     if unmined >= minestate.reminder_threshold():
         typer.echo(f"reminder   : {unmined} distinct sessions unmined "
                    f"— run `super-skill mine`")
@@ -189,9 +232,15 @@ def rollback(
     skill_id: str,
     to: str = typer.Option("", "--to", help="target version; default = previous"),
     reason: str = typer.Option("", "--reason"),
+    host: str = typer.Option("claude", "--host", help="re-materialize to: claude | codex | all"),
 ) -> None:
-    """Switch the active pointer to an older version and re-materialize to the host."""
+    """Switch the active pointer to an older version and re-materialize to the host(s)."""
     reg = _registry()
+    try:
+        hosts = config.resolve_hosts(host)
+    except ValueError as e:
+        typer.echo(str(e), err=True)
+        raise typer.Exit(1) from e
     rec = reg.get(skill_id)
     if rec is None:
         typer.echo(f"unknown skill: {skill_id}", err=True)
@@ -205,11 +254,11 @@ def rollback(
         to = versions[idx - 1]
     try:
         reg.set_active(skill_id, to, op=OperationType.ROLLBACK, reason=reason or None)
-        dest = reg.materialize(skill_id, config.host_skills_dir())
+        dests = [reg.materialize(skill_id, config.host_skills_dir(h)) for h in hosts]
     except RegistryError as e:
         typer.echo(str(e), err=True)
         raise typer.Exit(1) from e
-    typer.echo(f"rolled back {skill_id} -> {to}; materialized {dest}")
+    typer.echo(f"rolled back {skill_id} -> {to}; materialized {', '.join(str(d) for d in dests)}")
 
 
 @app.command()
@@ -281,7 +330,7 @@ def candidate_draft(min_sessions: int = typer.Option(3, "--min-sessions")) -> No
     store = CandidateStore(config.state_root())
     created = draft_from_families(store, families)
     # Drafting acts on the mining, so it too clears the status reminder.
-    minestate.record_mined(log.root, log.distinct_sessions())
+    minestate.record_mined(log.root, log.session_ids())
     if not created:
         typer.echo("no new candidates (nothing mined, or all already drafted)")
         return
@@ -338,12 +387,21 @@ def candidate_show(candidate_id: str) -> None:
 def candidate_approve(
     candidate_id: str,
     reason: str = typer.Option("", "--reason"),
+    host: str = typer.Option("claude", "--host", help="materialize to: claude | codex | all"),
 ) -> None:
-    """Approve a candidate: promote to the registry and materialize to the host."""
+    """Approve a candidate: promote to the registry and materialize to the host(s)."""
     store = CandidateStore(config.state_root())
     reg = _registry()
     try:
-        sv = approve(store, reg, candidate_id, config.host_skills_dir(), reason=reason or None)
+        hosts = config.resolve_hosts(host)
+    except ValueError as e:
+        typer.echo(str(e), err=True)
+        raise typer.Exit(1) from e
+    try:
+        sv = approve(store, reg, candidate_id, config.host_skills_dir(hosts[0]),
+                     reason=reason or None)
+        for extra in hosts[1:]:
+            reg.materialize(sv.skill_id, config.host_skills_dir(extra))
     except InstructionGateError as e:
         typer.echo(str(e), err=True)
         for f in e.findings:
@@ -359,9 +417,9 @@ def candidate_approve(
     except (CandidateError, RegistryError, SkillMdError) as e:
         typer.echo(str(e), err=True)
         raise typer.Exit(1) from e
+    dests = ", ".join(str(config.host_skills_dir(h) / sv.skill_id) for h in hosts)
     typer.echo(
-        f"approved {candidate_id} -> {sv.skill_id}@{sv.version}; "
-        f"materialized to {config.host_skills_dir() / sv.skill_id}"
+        f"approved {candidate_id} -> {sv.skill_id}@{sv.version}; materialized to {dests}"
     )