chore(knowledge): add course-digest skill + bundled extraction pipeline

[kyle-sexton]

Retrofit the course-digest skill (Dometrain/Teachable course extraction and repo-applicability synthesis) into the knowledge plugin, replicating the shipped youtube vendoring precedent. Pre-baked decisions from the source issue were honored, not re-litigated.

What changed

• Vendored shared libs — @melodic/repo-analysis + @melodic/video-digestion copied (runtime source only) into extraction/vendor/, each with its own trimmed package.json (real name/version/exports; video-digestion keeps its imghash runtime dep). package.json deps rewritten to file:./vendor/*. Byte-identical to the youtube skill's vendored copies (dedup of the two is tracked separately).
• Launcher trio — run.mjs / register-hook.mjs / resolve-hook.mjs resolve bundled deps from ${CLAUDE_PLUGIN_DATA} via an ESM resolve hook. setup-deps.mjs installs node deps into ${CLAUDE_PLUGIN_DATA} (sha256 fingerprint over package.json + vendor/, stamped .course-extraction.stamp) and provisions Playwright's Chromium into ${CLAUDE_PLUGIN_DATA}/ms-playwright. run.mjs pins PLAYWRIGHT_BROWSERS_PATH to that path so install-path and runtime-lookup-path stay in lockstep.
• Credentials (adapter-native, no sensitive userConfig) — login via the user's own COURSE_*/TEACHABLE_* shell env vars (prefix driven by platformConfig.authEnvPrefix), interactive manual-login fallback. Session cookies re-homed out of the consumer repo to ${CLAUDE_PLUGIN_DATA}/auth/<platform>.auth-state.json via lib/auth-store.js.
• Decoupling — inlined tsconfig.json (no cross-repo extends); genericized SKILL.md + context//reference/ paths to ${CLAUDE_PLUGIN_ROOT}; routed script invocations through run.mjs; namespaced self-referencing slashes to /knowledge:course-digest (and cross-refs to /knowledge:youtube); rewrote !-precompute probes to cross-platform node -e; fixed the build-course-json.js JSDoc example path.
• Version + catalog — knowledge plugin 0.4.0 → 0.5.0 (rebased on feat(knowledge/youtube): honor library_dir — wire resolved work root into the pipeline #145, which took 0.4.0), CHANGELOG 0.4.0 entry added (plus a backfilled 0.3.0 entry that PR chore(knowledge/setup): retrofit library_dir precedence + portability hardening #138 had omitted). Extended plugin keywords and marketplace tags with course/video terms.
• Excluded the ~2 GB data/ tree (consumer machine state, per the issue).

Verification

• claude plugin validate --strict — clean (plugin + marketplace).
• npx vitest run — 10 files, 91 tests pass; tsc --noEmit clean; markdownlint clean.
• Clean-repo smoke (scratchpad, CLAUDE_PLUGIN_DATA=temp, local node_modules absent):
  • setup-deps.mjs installed deps + Chromium into the data dir; re-run early-exits (idempotent).
  • Vendored @melodic/* + playwright bare imports resolved from ${CLAUDE_PLUGIN_DATA} (proved by running a pipeline script with no local node_modules).
  • Dry run reached the auth branch: Chromium launched from the data-dir path and control entered adapter.authenticate → clerkLogin, failing exactly as expected on a fake login page (no real credentials).

Implementation decisions (reviewer visibility)

• Auth is keyed per-platform, not per-course. The source issue framed the re-home as "location, not behavior"; per-platform is a slight behavior change but the correct shape (a login session is a platform session, reused across courses).
• Dev/test fallback when CLAUDE_PLUGIN_DATA is unset: ${home}/.claude/course-digest/auth/… — machine-local, persistent, out of the consumer repo.
• --course-dir stays caller-provided; full library_dir → course-dir auto-resolution (the youtube work-root analog) is not wired here — possible follow-up.
• Manual-login-under-headless may not function (documented as a known limitation, not a blocker); env-var + cookie-reuse carry the skill.

Refs melodic-software/medley#1409

---

Note

Medium Risk
Adds Playwright automation, course-platform credentials, and large new surface area (browser auth, vendored deps, long-running extraction), but credentials stay in env/plugin data and behavior is documented/tested rather than changing existing skills.

Overview
Knowledge plugin 0.5.0 adds /knowledge:course-digest: a multi-phase workflow to discover, extract, and synthesize Dometrain and Teachable courses into repo-applicable artifacts (repo-candidates.md, action-items.md), with single YouTube videos still routed to /knowledge:youtube.

The PR ships a bundled Node extraction stack (Playwright orchestration, ffmpeg/ImageMagick frame tooling, companion-repo analysis) following the youtube pattern: @melodic/repo-analysis and @melodic/video-digestion vendored under extraction/vendor/, setup-deps.mjs installing into ${CLAUDE_PLUGIN_DATA} plus Chromium under ms-playwright, and run.mjs resolving deps and pinning PLAYWRIGHT_BROWSERS_PATH. Platform adapters (dometrain, teachable) implement a shared contract (transcript, HLS, resources, URLs); shared Clerk / Teachable SSO auth and Mux / Hotmart player modules live under lib/.

Auth uses shell COURSE_* / TEACHABLE_* (from platformConfig.authEnvPrefix) with manual-login fallback; session state is stored per platform at ${CLAUDE_PLUGIN_DATA}/auth/<platform>.auth-state.json, not in the consumer repo. Skill docs cover the 8-phase pipeline, storage schema, evals, and prerequisites; marketplace/plugin metadata and CHANGELOG are updated (including a backfilled 0.3.0 entry).

^{Reviewed by Cursor Bugbot for commit 477e254. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_c8fdcac8-81f3-4485-8a43-acaafab1d1b6)

[cursor]

Stale comment

Risk: high. Did not approve: Cursor Bugbot completed as skipped (usage limit reached), so automated review did not finish successfully. Human review is required; no reviewers were assigned because no eligible reviewers were identifiable outside the author.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ddbd52f7f1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_5cfecd64-7d4f-4b9e-a130-690bc86072d6)

[cursor]

Risk: high. Did not approve: Cursor Bugbot completed as skipped (usage limit reached), so automated review did not finish successfully. Human review is required; no reviewers were assigned because no eligible reviewers were identifiable outside the author.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 12b4f9a711

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_5e086b86-8dd6-4d52-b7bd-c1cad8b1af89)

[cursor]

Risk: high. Did not approve: Cursor Bugbot completed as skipped (usage limit reached), so automated review did not finish successfully. Human review is required; no reviewers were assigned because no eligible reviewers were identifiable outside the author.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 477e2543de

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kyle-sexton]

Thanks @chatgpt-codex-connector. All 5 suggestions concern pre-existing pipeline behavior carried over verbatim from the source skill (resource-flag detection, the Teachable scaffold's hard-coded course metadata, post-auth navigation timing, completion persistence, and resource filename collisions) — none is introduced by this migration. This PR is a behavior-preserving retrofit into the plugin; changing that logic here would diverge the plugin copy from the source that the vendored-dedup follow-up must reconcile. Deferring them as out-of-scope; they are recorded as follow-up candidates in the completion note on the tracking issue.

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.