fix(clawdhub): default to sync and robust resolve check

Author: steipete

packages/clawdhub/src/cli.ts

@@ -10,6 +10,7 @@ import { configureCommanderHelp, styleEnvBlock, styleTitle } from './cli/helpSty
 import { DEFAULT_REGISTRY, DEFAULT_SITE } from './cli/registry.js'
 import type { GlobalOpts } from './cli/types.js'
 import { fail } from './cli/ui.js'
+import { readGlobalConfig } from './config.js'
 
 const program = new Command()
   .name('clawdhub')
@@ -187,6 +188,17 @@ program
     )
   })
 
+program.action(async () => {
+  const opts = resolveGlobalOpts()
+  const cfg = await readGlobalConfig()
+  if (cfg?.token) {
+    await cmdSync(opts, {}, isInputAllowed())
+    return
+  }
+  program.outputHelp()
+  process.exitCode = 0
+})
+
 void program.parseAsync(process.argv).catch((error) => {
   const message = error instanceof Error ? error.message : String(error)
   fail(message)

packages/clawdhub/src/cli/commands/sync.ts

@@ -1,3 +1,4 @@
+import { homedir } from 'node:os'
 import { resolve } from 'node:path'
 import { intro, isCancel, multiselect, note, outro, text } from '@clack/prompts'
 import {
@@ -8,8 +9,8 @@ import {
 } from '@clawdhub/schema'
 import semver from 'semver'
 import { readGlobalConfig } from '../../config.js'
-import { apiRequest } from '../../http.js'
-import { hashSkillFiles, listTextFiles } from '../../skills.js'
+import { apiRequest, downloadZip } from '../../http.js'
+import { hashSkillFiles, hashSkillZip, listTextFiles } from '../../skills.js'
 import { getRegistry } from '../registry.js'
 import { findSkillFolders, getFallbackSkillRoots, type SkillFolder } from '../scanSkills.js'
 import type { GlobalOpts } from '../types.js'
@@ -35,6 +36,7 @@ type Candidate = SkillFolder & {
 
 export async function cmdSync(opts: GlobalOpts, options: SyncOptions, inputAllowed: boolean) {
   const allowPrompt = isInteractive() && inputAllowed !== false
+  intro('ClawdHub sync')
 
   const cfg = await readGlobalConfig()
   const token = cfg?.token
@@ -44,22 +46,34 @@ export async function cmdSync(opts: GlobalOpts, options: SyncOptions, inputAllow
   const selectedRoots = buildScanRoots(opts, options.root)
 
   const spinner = createSpinner('Scanning for local skills')
-  let skills = await scanRoots(selectedRoots)
-  if (skills.length === 0) {
+  let scan = await scanRoots(selectedRoots)
+  if (scan.skills.length === 0) {
     const fallback = getFallbackSkillRoots(opts.workdir)
-    skills = await scanRoots(fallback)
+    scan = await scanRoots(fallback)
     spinner.stop()
-    if (skills.length === 0)
+    if (scan.skills.length === 0)
       fail('No skills found (checked workdir and known Clawdis/Clawd locations)')
-    note(`No skills in workdir. Found ${skills.length} in legacy locations.`, fallback.join('\n'))
+    note(
+      `No skills in workdir. Found ${scan.skills.length} in legacy locations.`,
+      formatList(scan.rootsWithSkills, 10),
+    )
   } else {
     spinner.stop()
   }
+  let skills = scan.skills
 
-  intro('ClawdHub sync')
+  skills = await maybeSelectLocalSkills(skills, {
+    allowPrompt,
+    all: Boolean(options.all),
+  })
+  if (skills.length === 0) {
+    outro('Nothing selected.')
+    return
+  }
 
   const candidatesSpinner = createSpinner('Checking registry sync state')
   const candidates: Candidate[] = []
+  let supportsResolve: boolean | null = null
   try {
     for (const skill of skills) {
       const filesOnDisk = await listTextFiles(skill.folder)
@@ -85,20 +99,37 @@ export async function cmdSync(opts: GlobalOpts, options: SyncOptions, inputAllow
         continue
       }
 
-      const resolved = await apiRequest(
-        registry,
-        {
-          method: 'GET',
-          path: `${ApiRoutes.skillResolve}?slug=${encodeURIComponent(skill.slug)}&hash=${encodeURIComponent(fingerprint)}`,
-        },
-        ApiSkillResolveResponseSchema,
-      ).catch((error) => {
-        const message = formatError(error)
-        if (/skill not found/i.test(message)) return { match: null, latestVersion: null }
-        throw error
-      })
+      let matchVersion: string | null = null
+      if (supportsResolve !== false) {
+        try {
+          const resolved = await apiRequest(
+            registry,
+            {
+              method: 'GET',
+              path: `${ApiRoutes.skillResolve}?slug=${encodeURIComponent(skill.slug)}&hash=${encodeURIComponent(fingerprint)}`,
+            },
+            ApiSkillResolveResponseSchema,
+          )
+          supportsResolve = true
+          matchVersion = resolved.match?.version ?? null
+        } catch (error) {
+          const message = formatError(error)
+          if (/skill not found/i.test(message)) {
+            matchVersion = null
+          } else if (/no matching routes found/i.test(message) || /not found/i.test(message)) {
+            supportsResolve = false
+          } else {
+            throw error
+          }
+        }
+      }
+
+      if (supportsResolve === false) {
+        const zip = await downloadZip(registry, { slug: skill.slug, version: latestVersion })
+        const remote = hashSkillZip(zip).fingerprint
+        matchVersion = remote === fingerprint ? latestVersion : null
+      }
 
-      const matchVersion = resolved.match?.version ?? null
       candidates.push({
         ...skill,
         fingerprint,
@@ -172,15 +203,45 @@ function buildScanRoots(opts: GlobalOpts, extraRoots: string[] | undefined) {
 
 async function scanRoots(roots: string[]) {
   const all: SkillFolder[] = []
+  const rootsWithSkills: string[] = []
   for (const root of roots) {
     const found = await findSkillFolders(root)
+    if (found.length > 0) rootsWithSkills.push(root)
     all.push(...found)
   }
   const byFolder = new Map<string, SkillFolder>()
   for (const folder of all) {
     byFolder.set(folder.folder, folder)
   }
-  return Array.from(byFolder.values())
+  return { skills: Array.from(byFolder.values()), rootsWithSkills }
+}
+
+async function maybeSelectLocalSkills(
+  skills: SkillFolder[],
+  params: { allowPrompt: boolean; all: boolean },
+): Promise<SkillFolder[]> {
+  if (params.all || !params.allowPrompt) return skills
+  if (skills.length <= 30) return skills
+
+  const valueByKey = new Map<string, SkillFolder>()
+  const choices = skills.map((skill) => {
+    const key = skill.folder
+    valueByKey.set(key, skill)
+    return {
+      value: key,
+      label: skill.slug,
+      hint: abbreviatePath(skill.folder),
+    }
+  })
+
+  const picked = await multiselect({
+    message: `Found ${skills.length} local skills — select what to sync`,
+    options: choices,
+    initialValues: [],
+    required: false,
+  })
+  if (isCancel(picked)) fail('Canceled')
+  return picked.map((key) => valueByKey.get(String(key))).filter(Boolean) as SkillFolder[]
 }
 
 async function selectToUpload(
@@ -207,7 +268,7 @@ async function selectToUpload(
   const picked = await multiselect({
     message: 'Select skills to upload',
     options: choices,
-    initialValues: choices.map((choice) => choice.value),
+    initialValues: candidates.length <= 10 ? choices.map((choice) => choice.value) : [],
     required: false,
   })
   if (isCancel(picked)) fail('Canceled')
@@ -255,3 +316,18 @@ async function getRegistryWithAuth(opts: GlobalOpts, token: string) {
   )
   return registry
 }
+
+function formatList(values: string[], max: number) {
+  if (values.length === 0) return ''
+  const shown = values.map(abbreviatePath)
+  if (shown.length <= max) return shown.join('\n')
+  const head = shown.slice(0, Math.max(1, max - 1))
+  const rest = values.length - head.length
+  return [...head, `… +${rest} more`].join('\n')
+}
+
+function abbreviatePath(value: string) {
+  const home = homedir()
+  if (value.startsWith(home)) return `~${value.slice(home.length)}`
+  return value
+}

packages/clawdhub/src/skills.test.ts

@@ -8,6 +8,7 @@ import {
   buildSkillFingerprint,
   extractZipToDir,
   hashSkillFiles,
+  hashSkillZip,
   listTextFiles,
   readLockfile,
   sha256Hex,
@@ -84,4 +85,18 @@ describe('skills', () => {
     ])
     expect(fingerprint).toBe(expected)
   })
+
+  it('hashes text files inside a downloaded zip deterministically', () => {
+    const zip = zipSync({
+      'SKILL.md': strToU8('hello'),
+      'notes.md': strToU8('world'),
+      'image.png': strToU8('nope'),
+    })
+    const { fingerprint } = hashSkillZip(new Uint8Array(zip))
+    const expected = buildSkillFingerprint([
+      { path: 'SKILL.md', sha256: sha256Hex(strToU8('hello')) },
+      { path: 'notes.md', sha256: sha256Hex(strToU8('world')) },
+    ])
+    expect(fingerprint).toBe(expected)
+  })
 })

packages/clawdhub/src/skills.ts

@@ -63,6 +63,21 @@ export function hashSkillFiles(files: Array<{ relPath: string; bytes: Uint8Array
   return { files: hashed, fingerprint: buildSkillFingerprint(hashed) }
 }
 
+export function hashSkillZip(zipBytes: Uint8Array) {
+  const entries = unzipSync(zipBytes)
+  const hashed = Object.entries(entries)
+    .map(([rawPath, bytes]) => {
+      const safePath = sanitizeZipPath(rawPath)
+      if (!safePath) return null
+      const ext = safePath.split('.').at(-1)?.toLowerCase() ?? ''
+      if (!ext || !TEXT_FILE_EXTENSION_SET.has(ext)) return null
+      return { path: safePath, sha256: sha256Hex(bytes), size: bytes.byteLength }
+    })
+    .filter(Boolean) as SkillFileHash[]
+
+  return { files: hashed, fingerprint: buildSkillFingerprint(hashed) }
+}
+
 export async function readLockfile(workdir: string): Promise<Lockfile> {
   const path = join(workdir, '.clawdhub', 'lock.json')
   try {
@@ -94,6 +109,10 @@ function sanitizeRelPath(path: string) {
   return normalized
 }
 
+function sanitizeZipPath(path: string) {
+  return sanitizeRelPath(path)
+}
+
 async function walk(dir: string, onFile: (path: string) => Promise<void>) {
   const entries = await readdir(dir, { withFileTypes: true })
   for (const entry of entries) {