Defensibility moats + viral growth loops

.env.example

@@ -0,0 +1,36 @@
+# =============================================================================
+# Super Agent Skill — environment template
+# Copy to .env and fill in. Never commit real secrets.
+# =============================================================================
+
+# --- Core (existing) ---------------------------------------------------------
+VITE_SUPABASE_URL=https://<project>.supabase.co
+VITE_SUPABASE_ANON_KEY=
+SUPABASE_URL=https://<project>.supabase.co
+SUPABASE_SERVICE_ROLE_KEY=
+SUPABASE_JWT_SECRET=
+
+# --- AI Gateway --------------------------------------------------------------
+AI_GATEWAY_BASE_URL=https://api.openai.com/v1
+AI_GATEWAY_API_KEY=
+AI_GATEWAY_MODEL=openai/gpt-4o-mini
+
+# --- Trust Score: release signing (Phase 2 + Phase 6) ------------------------
+# Generate locally with:
+#   openssl genpkey -algorithm ed25519 -out priv.pem
+#   openssl pkey -in priv.pem -pubout -out pub.pem
+# Then export the PEM contents (multi-line preserved):
+#   export SIGNING_PRIVATE_KEY="$(cat priv.pem)"
+#   export SIGNING_PUBLIC_KEY="$(cat pub.pem)"
+SIGNING_PRIVATE_KEY=
+SIGNING_PUBLIC_KEY=
+
+# --- Telemetry anonymization (Phase 2) ---------------------------------------
+# Any high-entropy string >= 32 chars. Workspaces are hashed with this salt
+# before storage so analytics never sees raw workspace ids.
+TELEMETRY_SALT=change-me-to-a-long-random-string
+
+# --- CLI distribution (Phase 4 / viral) --------------------------------------
+# Override only for self-hosted registries; users normally don't set this.
+SUPER_AGENT_REGISTRY=https://superagentskill.com
+SUPER_AGENT_TELEMETRY=1

.github/workflows/test.yml

@@ -0,0 +1,31 @@
+name: tests
+on:
+  push:
+    branches: [main]
+  pull_request:
+jobs:
+  node-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+      - run: npm ci
+      - name: Plain node:test suites
+        run: |
+          node --test \
+            tests/adversarial-harness.test.mjs \
+            tests/trust.test.mjs \
+            tests/release-signing.test.mjs \
+            tests/cli-install.test.mjs
+      - name: TypeScript-source node:test suites
+        run: |
+          node --experimental-strip-types --test \
+            tests/prompt-injection-guard.test.mjs \
+            tests/runtime.test.mjs \
+            tests/integrations.test.mjs \
+            tests/growth-revenue-split.test.mjs \
+            tests/trust-badge.test.mjs \
+            tests/bounties.test.mjs

cli/README.md

@@ -0,0 +1,34 @@
+# super-agent
+
+One-line installer for Super Agent Skill packages. Drops the right files
+into your project so Claude Code, Cursor, Continue, or Cline picks the
+skill up automatically.
+
+```bash
+npx super-agent install code-reviewer
+# → .claude/skills/code-reviewer/SKILL.md
+# → .cursor/rules/code-reviewer.mdc
+# → .continue/skills/code-reviewer.md
+# → .cline/skills/code-reviewer.md
+```
+
+## Commands
+
+```bash
+npx super-agent install <slug> [--target claude|cursor|continue|cline|all]
+npx super-agent list   [--query <q>]
+npx super-agent search <q>
+npx super-agent info   <slug>
+```
+
+## Env
+
+- `SUPER_AGENT_REGISTRY` — override registry origin (default `https://superagentskill.com`)
+- `SUPER_AGENT_TELEMETRY=0` — disable anonymized install telemetry
+
+## Why use it
+
+- **No login** for public packages — pulls straight from the public registry.
+- **Trust signal** — every package comes with a verifiable Trust Score badge
+  (`/api/badges/trust/<slug>.svg`).
+- **Cross-IDE** — one command installs to every agent you use.

cli/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "super-agent",
+  "version": "0.1.0",
+  "description": "Install Super Agent Skill packages locally for Claude / Cursor / Continue / Cline.",
+  "type": "module",
+  "bin": {
+    "super-agent": "./super-agent.mjs"
+  },
+  "files": ["super-agent.mjs", "README.md"],
+  "keywords": ["claude", "cursor", "continue", "cline", "mcp", "skill", "agent", "ai"],
+  "license": "MIT",
+  "engines": { "node": ">=18" },
+  "homepage": "https://superagentskill.com",
+  "repository": { "type": "git", "url": "https://github.com/criptogus/agent-evolve-network", "directory": "cli" }
+}

cli/super-agent.mjs

@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+// Super Agent Skill CLI — one-line distribution for any IDE/agent that reads
+// local instruction files.
+//
+// Usage:
+//   npx super-agent install <slug> [--target claude|cursor|continue|cline|all]
+//   npx super-agent list [--query <q>]
+//   npx super-agent search <q>
+//   npx super-agent info <slug>
+//
+// Installs an Anthropic-compatible SKILL.md (or each target's local convention)
+// into the current working directory. No login required for public packages —
+// downloads via the public registry HTTPS endpoints.
+
+import { mkdirSync, writeFileSync, existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+const REGISTRY = process.env.SUPER_AGENT_REGISTRY ?? "https://superagentskill.com";
+const TELEMETRY = process.env.SUPER_AGENT_TELEMETRY !== "0";
+
+const [cmd, ...rest] = process.argv.slice(2);
+if (!cmd || cmd === "--help" || cmd === "-h") {
+  printHelp(); process.exit(0);
+}
+
+try {
+  if (cmd === "install") await cmdInstall(rest);
+  else if (cmd === "list") await cmdList(rest);
+  else if (cmd === "search") await cmdSearch(rest);
+  else if (cmd === "info") await cmdInfo(rest);
+  else { console.error(`unknown command: ${cmd}`); printHelp(); process.exit(1); }
+} catch (e) {
+  console.error(`✗ ${e.message}`);
+  process.exit(2);
+}
+// fetch keep-alive sockets can keep the loop alive ~30s; force a clean exit.
+setImmediate(() => process.exit(0));
+
+function printHelp() {
+  console.log(`super-agent — install AI agent skills locally
+
+Commands:
+  install <slug> [--target claude|cursor|continue|cline|all]   default: all
+  list   [--query <q>]
+  search <q>
+  info   <slug>
+
+Environment:
+  SUPER_AGENT_REGISTRY   override registry origin (default https://superagentskill.com)
+  SUPER_AGENT_TELEMETRY  set to 0 to disable anonymized install telemetry
+`);
+}
+
+function parseFlags(args) {
+  const positional = []; const flags = {};
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a.startsWith("--")) { const n = args[i + 1]; if (!n || n.startsWith("--")) flags[a.slice(2)] = true; else { flags[a.slice(2)] = n; i++; } }
+    else positional.push(a);
+  }
+  return { positional, flags };
+}
+
+async function getJson(path) {
+  const res = await fetch(`${REGISTRY}${path}`, { headers: { accept: "application/json" } });
+  if (!res.ok) throw new Error(`HTTP ${res.status} from ${path}`);
+  return res.json();
+}
+
+async function getText(path) {
+  const res = await fetch(`${REGISTRY}${path}`);
+  if (!res.ok) throw new Error(`HTTP ${res.status} from ${path}`);
+  return res.text();
+}
+
+async function cmdInstall(args) {
+  const { positional, flags } = parseFlags(args);
+  const slug = positional[0];
+  if (!slug) throw new Error("install requires <slug>");
+  const target = (flags.target ?? "all").toLowerCase();
+
+  console.log(`→ fetching ${slug} from ${REGISTRY}`);
+  const info = await getJson(`/api/public/packages/${slug}`);
+  const skillMd = await getText(`/api/skills/${slug}/export.md`).catch(async () => {
+    // Fallback: synthesize from the public manifest fields.
+    return synthesizeSkillMd(info);
+  });
+
+  const targets = target === "all" ? ["claude", "cursor", "continue", "cline"] : [target];
+  for (const t of targets) writeForTarget(t, slug, skillMd);
+
+  reportTelemetry({ package_slug: slug, runtime: "cli", success: true });
+  console.log(`\n✓ installed ${slug} for: ${targets.join(", ")}`);
+  console.log(`  trust score: ${REGISTRY}/api/badges/trust/${slug}.svg`);
+  console.log(`  package:     ${REGISTRY}/packs/${slug}`);
+}
+
+function writeForTarget(target, slug, skillMd) {
+  const map = {
+    claude:   `.claude/skills/${slug}/SKILL.md`,
+    cursor:   `.cursor/rules/${slug}.mdc`,
+    continue: `.continue/skills/${slug}.md`,
+    cline:    `.cline/skills/${slug}.md`,
+  };
+  const path = map[target];
+  if (!path) { console.warn(`  ! unknown target: ${target}`); return; }
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, skillMd);
+  console.log(`  + ${path}`);
+}
+
+async function cmdList(args) {
+  const { flags } = parseFlags(args);
+  const q = flags.query ?? "";
+  const list = await getJson(`/api/public/packages?type=skill${q ? `&q=${encodeURIComponent(q)}` : ""}`);
+  for (const p of list.items ?? list) {
+    console.log(`${p.slug.padEnd(36)} ${p.name ?? ""}`);
+  }
+}
+
+async function cmdSearch(args) {
+  if (!args[0]) throw new Error("search requires a query");
+  const res = await getJson(`/api/public/search?q=${encodeURIComponent(args.join(" "))}`);
+  for (const r of res.results ?? []) {
+    console.log(`${r.type.padEnd(10)} ${r.slug.padEnd(32)} ${r.score?.toFixed?.(2) ?? ""}  ${r.snippet ?? ""}`);
+  }
+}
+
+async function cmdInfo(args) {
+  const slug = args[0];
+  if (!slug) throw new Error("info requires <slug>");
+  const info = await getJson(`/api/public/packages/${slug}`);
+  console.log(JSON.stringify(info, null, 2));
+}
+
+function synthesizeSkillMd(info) {
+  const lines = [
+    `# ${info.name ?? info.slug}`,
+    ``,
+    info.description ?? "",
+    ``,
+    `## When to use`,
+    info.trigger ?? info.when_to_use ?? "(see package page)",
+    ``,
+    `## System prompt`,
+    info.system_prompt ?? "(not exposed via this endpoint)",
+    ``,
+    `---`,
+    `Installed from ${REGISTRY}/packs/${info.slug}`,
+  ];
+  return lines.join("\n");
+}
+
+function reportTelemetry(event) {
+  if (!TELEMETRY) return;
+  const body = JSON.stringify({ ...event, latency_ms: 0, workspace_id: hashCwd() });
+  // Fire-and-forget; never block the CLI.
+  fetch(`${REGISTRY}/api/telemetry`, {
+    method: "POST", headers: { "content-type": "application/json" }, body,
+  }).catch(() => {});
+}
+
+function hashCwd() {
+  try {
+    const cwd = process.cwd();
+    const pkg = existsSync("package.json") ? JSON.parse(readFileSync("package.json", "utf8"))?.name : "";
+    // No salt — server-side anonymization will hash again.
+    return `${pkg || "anon"}:${cwd.split("/").slice(-2).join("/")}`;
+  } catch { return "anon"; }
+}

content/integrations/_template.yaml

@@ -0,0 +1,28 @@
+slug: example
+name: Example
+type: integration
+version: 0.1.0
+provider: Example Inc.
+description: One-line description of what this integration enables (>= 20 chars).
+auth:
+  kind: api_key
+  api_key:
+    header: X-API-Key
+    env_hint: EXAMPLE_API_KEY
+required_scopes: []
+actions:
+  - id: example_read
+    name: Read something
+    method: GET
+    base_url: https://api.example.com
+    path: /v1/things
+    side_effect: read
+  - id: example_write
+    name: Write something
+    method: POST
+    base_url: https://api.example.com
+    path: /v1/things
+    side_effect: write
+tags: []
+license: MIT
+authors: ["You"]

content/integrations/datadog.yaml

@@ -0,0 +1,35 @@
+slug: datadog
+name: Datadog
+type: integration
+version: 0.1.0
+provider: Datadog, Inc.
+description: Query metrics, logs and monitors from Datadog for incident-response playbooks.
+homepage: https://www.datadoghq.com
+auth:
+  kind: api_key
+  api_key:
+    header: DD-API-KEY
+    env_hint: DD_API_KEY
+required_scopes: []
+actions:
+  - id: query_metric
+    name: Query a metric timeseries
+    method: GET
+    base_url: https://api.datadoghq.com/api/v1
+    path: /query
+    side_effect: read
+  - id: list_monitors
+    name: List monitors
+    method: GET
+    base_url: https://api.datadoghq.com/api/v1
+    path: /monitor
+    side_effect: read
+  - id: mute_monitor
+    name: Mute monitor
+    method: POST
+    base_url: https://api.datadoghq.com/api/v1
+    path: /monitor/{monitor_id}/mute
+    side_effect: write
+tags: [observability, sre, incidents]
+license: MIT
+authors: ["SuperAgentSkill Team"]