Add .well-known/agent-skills/ discovery as a new skill source

[olaservo]

Summary

• Adds consumer-side support for the agent-skills discovery RFC (v0.2.0). Skilljack can now pull skills from any HTTPS publisher serving /.well-known/agent-skills/index.json, alongside existing local + GitHub sources.
• Every artifact is SHA-256 verified against the publisher's index entry; mismatches are rejected before anything is written to disk.
• Both skill-md (single SKILL.md) and archive (.tar.gz / .zip) entry types are supported, with safety checks for path traversal, symlinks, decompression bombs, and an enforced size cap.
• Mirrors the existing GitHub source: default-deny allowlist (WELL_KNOWN_ALLOWED_ORIGINS), 5-min polling with ETag-driven conditional refetch, per-publisher cache directory, prune-on-removal.

What's new

Area	What changed
src/well-known-config.ts	URL detection (isWellKnownUrl), normalization (auto-appends /.well-known/agent-skills), allowlist (isOriginAllowed), cache-path helpers, env-var config
src/well-known-sync.ts	syncWellKnown orchestrates fetch → validate → digest-verify → write/extract; safe tar/yauzl-promise extraction; index pruning; conditional refresh via ETag
src/well-known-polling.ts	Polling manager with the same shape as github-polling.ts
src/index.ts	Third bucket in classifyPaths, well-known sync at startup + on UI refresh, second polling manager
src/skill-config.ts / src/skill-discovery.ts / src/skill-display-tool.ts	SourceType and SkillSource.type extended with \"well-known\"
src/ui/skill-display.{ts,css}	New source badge for well-known publishers
src/ui/mcp-app.{ts,html}	Directory type union widened; blocked-state check now covers well-known too; add-directory placeholder/help text mention the URL form
package.json	tar + yauzl-promise (with a small ambient .d.ts since the latter ships no types). Bumped to 0.12.0.
README.md / CLAUDE.md	Usage example + new env vars + architecture notes

Configuration

WELL_KNOWN_ALLOWED_ORIGINS=https://example.com \
  skilljack-mcp https://example.com/.well-known/agent-skills/

Other env vars: WELL_KNOWN_POLL_INTERVAL_MS (default 300000), WELL_KNOWN_MAX_ARTIFACT_MB (10), WELL_KNOWN_MAX_UNPACKED_MB (50), WELL_KNOWN_ALLOW_HTTP (dev only).

Tests

28 new tests across well-known-{config,sync,polling}.test.ts use a local http.createServer fixture (no network). They cover:

• URL parsing / normalization / allowlist gating
• Index shape validation ($schema versioning, malformed digests, invalid skill names, unknown type values)
• skill-md happy path + digest mismatch rejection + size-cap rejection
• tar.gz archive happy path (multi-file)
• tar.gz archive missing SKILL.md rejection
• tar.gz archive with ../escape path-traversal entry rejection
• Pruning per-skill cache dirs when a skill is removed from the index
• Idempotent re-sync (no work when digests unchanged)
• Top-level error when index.json cannot be fetched
• Polling: onUpdate fires only when the index actually changes; timer doesn't start when interval ≤ 0 or no specs

Full suite: 217 / 217 passing, build clean.

Out of scope (intentional)

A full UI for managing the well-known origin allowlist (parallel to the existing "Allowed Orgs" panel) is deferred to a follow-up PR — it would add new server tools, a new HTML panel, and ~300 LOC of UI code best reviewed on its own. For now, configure via WELL_KNOWN_ALLOWED_ORIGINS or ~/.skilljack/config.json.

Publisher-mode (this server exposing its skills at .well-known/agent-skills/) is also out of scope; buildSkillIndex() already produces the right document shape, but no HTTP transport is added.

Test plan

• npm install, npm run build, npm test — all green locally.
• Spin up a local HTTPS publisher (or use the test fixtures) and add it via WELL_KNOWN_ALLOWED_ORIGINS=… npm run inspector https://…/.well-known/agent-skills/.
• Verify skills appear in tools/list, prompts/list, and skill://…/SKILL.md resources.
• Modify the publisher's SKILL.md + bump its digest in index.json; confirm notifications/tools/list_changed fires within 5 minutes.
• Confirm a digest-tampered artifact is rejected (logs an error, skill is not written).
• Confirm an origin not on the allowlist is reported as blocked at startup.
• Confirm an archive entry with .. is rejected.

🤖 Generated with Claude Code