Function installFromNpm

src/skills/installer.ts:96–117

(spec: string, originalSource: string, opts: { force?: boolean })

}

async function installFromNpm(spec: string, originalSource: string, opts: { force?: boolean }): Promise<InstallResult> {
  const tmp = await mkdtempIn(os.tmpdir(), 'qodex-skill-npm-');
  // `npm pack` writes the tgz to cwd, so cd into tmp first
  const packResult = spawnSync('npm', ['pack', spec], { cwd: tmp, encoding: 'utf-8' });
  if (packResult.status !== 0) {
    throw new Error(`npm pack ${spec} failed: ${packResult.stderr || packResult.stdout || 'unknown error'}`);
  }
  const tgzName = packResult.stdout.trim().split('\n').filter(Boolean).pop();
  if (!tgzName) throw new Error(`npm pack produced no tarball for ${spec}.`);
  const tgzPath = path.join(tmp, tgzName);
  runOrThrow('tar', ['-xzf', tgzPath, '-C', tmp], 'extract npm tarball');
  // npm tarballs extract under a "package/" subdir
  const pkgDir = path.join(tmp, 'package');
  let root: string;
  try {
    await fs.stat(pkgDir);
    root = await findSkillRoot(pkgDir);
  } catch {
    root = await findSkillRoot(tmp);
  }
  return copyInto(root, originalSource, opts);
}

/** Walk a freshly extracted source looking for a SKILL.md root. */
async function findSkillRoot(src: string): Promise<string> {