@alwaysmeticulous/cli 2.326.1 → 2.328.0

package/dist/commands/onboard/print-summary.js

@@ -0,0 +1,49 @@
+"use strict";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="30dac2bd-f754-5c4e-83eb-4f27d7ed6bfe")}catch(e){}}();
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printOnboardSummary = void 0;
+const chalk_1 = __importDefault(require("chalk"));
+/** Prints what the onboard run resolved, before any agent takes over the terminal. */
+const printOnboardSummary = (options) => {
+    const { context, frameworkDetection, projectRoot, workspaceDir } = options;
+    console.log("");
+    console.log(chalk_1.default.bold("Meticulous onboard"));
+    console.log(`  Project:   ${chalk_1.default.green(context.orgAndProject ?? "(unknown — set tokens in the dashboard)")}`);
+    const vcsLine = formatVcsLinkLine(context);
+    if (vcsLine) {
+        console.log(vcsLine);
+    }
+    console.log(`  App:       ${chalk_1.default.green(`${context.selectedAppName} (${context.selectedAppPath})`)}${context.isMonorepo ? chalk_1.default.dim(" [monorepo]") : ""}`);
+    console.log(`  Framework: ${chalk_1.default.green(`${frameworkDetection.framework} / ${frameworkDetection.rendering}`)}`);
+    console.log(`  Repo:      ${chalk_1.default.green(projectRoot)}`);
+    console.log(`  Workspace: ${chalk_1.default.green(workspaceDir)}`);
+    console.log("");
+};
+exports.printOnboardSummary = printOnboardSummary;
+const formatVcsLinkLine = (context) => {
+    switch (context.ciProvider) {
+        case "github-actions":
+            return `  GitHub:    ${linkStatus(context.isGitHubIntegrationActive)}`;
+        case "gitlab-ci":
+            return `  GitLab:    ${linkStatus(context.isGitLabIntegrationActive)}`;
+        case "bitbucket-pipelines":
+            return `  Bitbucket: ${linkStatus(context.isBitbucketIntegrationActive)}`;
+        default:
+            return null;
+    }
+};
+const linkStatus = (linked) => {
+    if (linked === true) {
+        return chalk_1.default.green("linked");
+    }
+    if (linked === false) {
+        return chalk_1.default.yellow("not linked");
+    }
+    return chalk_1.default.dim("unknown");
+};
+//# sourceMappingURL=print-summary.js.map
+//# debugId=30dac2bd-f754-5c4e-83eb-4f27d7ed6bfe

package/dist/commands/onboard/print-summary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"print-summary.js","sources":["../../../src/commands/onboard/print-summary.ts"],"sourceRoot":"","names":[],"mappings":";;;;;;;;AAAA,kDAA0B;AAI1B,sFAAsF;AAC/E,MAAM,mBAAmB,GAAG,CAAC,OAKnC,EAAQ,EAAE;IACT,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAE3E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CACT,gBAAgB,eAAK,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,IAAI,yCAAyC,CAAC,EAAE,CAClG,CAAC;IACF,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,GAAG,CACT,gBAAgB,eAAK,CAAC,KAAK,CACzB,GAAG,OAAO,CAAC,eAAe,KAAK,OAAO,CAAC,eAAe,GAAG,CAC1D,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,eAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CACzD,CAAC;IACF,OAAO,CAAC,GAAG,CACT,gBAAgB,eAAK,CAAC,KAAK,CACzB,GAAG,kBAAkB,CAAC,SAAS,MAAM,kBAAkB,CAAC,SAAS,EAAE,CACpE,EAAE,CACJ,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,gBAAgB,eAAK,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,gBAAgB,eAAK,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC,CAAC;AA9BW,QAAA,mBAAmB,uBA8B9B;AAEF,MAAM,iBAAiB,GAAG,CAAC,OAA2B,EAAiB,EAAE;IACvE,QAAQ,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3B,KAAK,gBAAgB;YACnB,OAAO,gBAAgB,UAAU,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACzE,KAAK,WAAW;YACd,OAAO,gBAAgB,UAAU,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACzE,KAAK,qBAAqB;YACxB,OAAO,gBAAgB,UAAU,CAAC,OAAO,CAAC,4BAA4B,CAAC,EAAE,CAAC;QAC5E;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,MAAsB,EAAU,EAAE;IACpD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,eAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,eAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,eAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC9B,CAAC,CAAC","debugId":"30dac2bd-f754-5c4e-83eb-4f27d7ed6bfe"}

package/dist/commands/onboard/resolve-app.d.ts

@@ -0,0 +1,21 @@
+import { type FrameworkDetection } from "./detect-framework";
+import { type DiscoveredApp } from "./discover-apps";
+/**
+ * Picks the frontend app to onboard: the `--app` match, the only discovered
+ * app, or an interactive picker when the repo is a monorepo.
+ */
+export declare const resolveSelectedApp: (options: {
+    projectRoot: string;
+    app: string | undefined;
+}) => Promise<DiscoveredApp>;
+/**
+ * Warns about unsupported SSR before anything is written and lets the user
+ * decide whether to continue. Non-interactive runs require the explicit
+ * `--skip-ssr-check` override because there is nobody to confirm.
+ */
+export declare const assertSupportedSsr: (options: {
+    detection: FrameworkDetection;
+    selectedApp: DiscoveredApp;
+    skipSsrCheck: boolean;
+}) => Promise<void>;
+//# sourceMappingURL=resolve-app.d.ts.map

package/dist/commands/onboard/resolve-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-app.d.ts","sourceRoot":"","sources":["../../../src/commands/onboard/resolve-app.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,iBAAiB,CAAC;AAEzB;;;GAGG;AACH,eAAO,MAAM,kBAAkB,YAAmB;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACzB,KAAG,OAAO,CAAC,aAAa,CAgCxB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,YAAmB;IAChD,SAAS,EAAE,kBAAkB,CAAC;IAC9B,WAAW,EAAE,aAAa,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;CACvB,KAAG,OAAO,CAAC,IAAI,CAqCf,CAAC"}

package/dist/commands/onboard/resolve-app.js

@@ -0,0 +1,78 @@
+"use strict";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cb20c9e0-2694-552a-98a7-eff127612376")}catch(e){}}();
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertSupportedSsr = exports.resolveSelectedApp = void 0;
+const client_1 = require("@alwaysmeticulous/client");
+const chalk_1 = __importDefault(require("chalk"));
+const inquirer_1 = __importDefault(require("inquirer"));
+const cli_user_error_1 = require("../../utils/cli-user-error");
+const detect_framework_1 = require("./detect-framework");
+const discover_apps_1 = require("./discover-apps");
+/**
+ * Picks the frontend app to onboard: the `--app` match, the only discovered
+ * app, or an interactive picker when the repo is a monorepo.
+ */
+const resolveSelectedApp = async (options) => {
+    const apps = (0, discover_apps_1.discoverFrontendApps)(options.projectRoot);
+    if (options.app) {
+        const requested = options.app.trim();
+        const match = apps.find((app) => app.path === requested ||
+            app.name === requested ||
+            app.packageName === requested);
+        if (!match) {
+            throw new cli_user_error_1.CliUserError(`App '${requested}' not found. Available frontend apps:\n${formatAppList(apps)}`);
+        }
+        return match;
+    }
+    if (apps.length <= 1) {
+        return apps[0] ?? { path: ".", name: "app", packageName: null };
+    }
+    if (!(0, client_1.isInteractiveContext)()) {
+        throw new cli_user_error_1.CliUserError("Multiple frontend apps detected in this monorepo, but no interactive terminal is available.\n" +
+            "Pass `--app <path-or-name>` to choose one:\n" +
+            formatAppList(apps));
+    }
+    return (0, discover_apps_1.promptForMonorepoApp)(apps);
+};
+exports.resolveSelectedApp = resolveSelectedApp;
+/**
+ * Warns about unsupported SSR before anything is written and lets the user
+ * decide whether to continue. Non-interactive runs require the explicit
+ * `--skip-ssr-check` override because there is nobody to confirm.
+ */
+const assertSupportedSsr = async (options) => {
+    const { detection, selectedApp, skipSsrCheck } = options;
+    if (!detection.isUnsupportedSsr || skipSsrCheck) {
+        return;
+    }
+    const appLabel = `${selectedApp.name} (${selectedApp.path})`;
+    console.log(chalk_1.default.yellow((0, detect_framework_1.unsupportedSsrWarningMessage)(detection)));
+    console.log(chalk_1.default.dim(`  Selected app: ${appLabel}`));
+    console.log("");
+    if (!(0, client_1.isInteractiveContext)()) {
+        throw new cli_user_error_1.CliUserError(`${(0, detect_framework_1.unsupportedSsrMessage)(detection)}\n\nSelected app: ${appLabel}\n\n` +
+            "There is no interactive terminal to confirm that you want to continue. " +
+            "Re-run with `--skip-ssr-check` to accept this risk.");
+    }
+    const { proceed } = await inquirer_1.default.prompt([
+        {
+            type: "confirm",
+            name: "proceed",
+            message: detection.framework === "nextjs-app"
+                ? `We think ${appLabel} uses Next.js App Router. Continue anyway?`
+                : `We think ${appLabel} is an unsupported SSR setup. Continue anyway?`,
+            default: false,
+        },
+    ]);
+    if (!proceed) {
+        throw new cli_user_error_1.CliUserError(`${(0, detect_framework_1.unsupportedSsrMessage)(detection)}\n\nSelected app: ${appLabel}`);
+    }
+};
+exports.assertSupportedSsr = assertSupportedSsr;
+const formatAppList = (apps) => apps.map((app) => `  - ${app.name} (${app.path})`).join("\n");
+//# sourceMappingURL=resolve-app.js.map
+//# debugId=cb20c9e0-2694-552a-98a7-eff127612376

package/dist/commands/onboard/resolve-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-app.js","sources":["../../../src/commands/onboard/resolve-app.ts"],"sourceRoot":"","names":[],"mappings":";;;;;;;;AAAA,qDAAgE;AAChE,kDAA0B;AAC1B,wDAAgC;AAChC,+DAA0D;AAC1D,yDAI4B;AAC5B,mDAIyB;AAEzB;;;GAGG;AACI,MAAM,kBAAkB,GAAG,KAAK,EAAE,OAGxC,EAA0B,EAAE;IAC3B,MAAM,IAAI,GAAG,IAAA,oCAAoB,EAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAEvD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CACrB,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,IAAI,KAAK,SAAS;YACtB,GAAG,CAAC,IAAI,KAAK,SAAS;YACtB,GAAG,CAAC,WAAW,KAAK,SAAS,CAChC,CAAC;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,6BAAY,CACpB,QAAQ,SAAS,0CAA0C,aAAa,CAAC,IAAI,CAAC,EAAE,CACjF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,IAAA,6BAAoB,GAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,6BAAY,CACpB,+FAA+F;YAC7F,8CAA8C;YAC9C,aAAa,CAAC,IAAI,CAAC,CACtB,CAAC;IACJ,CAAC;IAED,OAAO,IAAA,oCAAoB,EAAC,IAAI,CAAC,CAAC;AACpC,CAAC,CAAC;AAnCW,QAAA,kBAAkB,sBAmC7B;AAEF;;;;GAIG;AACI,MAAM,kBAAkB,GAAG,KAAK,EAAE,OAIxC,EAAiB,EAAE;IAClB,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IACzD,IAAI,CAAC,SAAS,CAAC,gBAAgB,IAAI,YAAY,EAAE,CAAC;QAChD,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,WAAW,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,GAAG,CAAC;IAE7D,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,IAAA,+CAA4B,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,CAAC,IAAA,6BAAoB,GAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,6BAAY,CACpB,GAAG,IAAA,wCAAqB,EAAC,SAAS,CAAC,qBAAqB,QAAQ,MAAM;YACpE,yEAAyE;YACzE,qDAAqD,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAQ,CAAC,MAAM,CAAuB;QAC9D;YACE,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,SAAS;YACf,OAAO,EACL,SAAS,CAAC,SAAS,KAAK,YAAY;gBAClC,CAAC,CAAC,YAAY,QAAQ,4CAA4C;gBAClE,CAAC,CAAC,YAAY,QAAQ,gDAAgD;YAC1E,OAAO,EAAE,KAAK;SACf;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,6BAAY,CACpB,GAAG,IAAA,wCAAqB,EAAC,SAAS,CAAC,qBAAqB,QAAQ,EAAE,CACnE,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAzCW,QAAA,kBAAkB,sBAyC7B;AAEF,MAAM,aAAa,GAAG,CAAC,IAAqB,EAAU,EAAE,CACtD,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC","debugId":"cb20c9e0-2694-552a-98a7-eff127612376"}

package/dist/commands/onboard/resolve-project.d.ts

@@ -0,0 +1,14 @@
+import type { Project } from "@alwaysmeticulous/api";
+/**
+ * Resolves which Meticulous project this onboard run is for.
+ *
+ * - Interactive OAuth: searchable picker (type to filter, ↑/↓ to select).
+ * - `--project` / sole accessible project / project-scoped API token: no prompt.
+ * - Non-interactive OAuth with several projects: requires `--project`.
+ * - Auth failure: returns null and continues with local git context only.
+ */
+export declare const resolveOnboardProject: (options: {
+    apiToken: string | undefined;
+    project: string | undefined;
+}) => Promise<Project | null>;
+//# sourceMappingURL=resolve-project.d.ts.map

package/dist/commands/onboard/resolve-project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-project.d.ts","sourceRoot":"","sources":["../../../src/commands/onboard/resolve-project.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAmBrD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,YAAmB;IACnD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,KAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAwCzB,CAAC"}

package/dist/commands/onboard/resolve-project.js

@@ -0,0 +1,92 @@
+"use strict";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f160cb06-1427-52cc-8b70-5fb6d2b32d44")}catch(e){}}();
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveOnboardProject = void 0;
+const client_1 = require("@alwaysmeticulous/client");
+const chalk_1 = __importDefault(require("chalk"));
+const cli_user_error_1 = require("../../utils/cli-user-error");
+const select_project_1 = require("../../utils/select-project");
+/**
+ * Resolves which Meticulous project this onboard run is for.
+ *
+ * - Interactive OAuth: searchable picker (type to filter, ↑/↓ to select).
+ * - `--project` / sole accessible project / project-scoped API token: no prompt.
+ * - Non-interactive OAuth with several projects: requires `--project`.
+ * - Auth failure: returns null and continues with local git context only.
+ */
+const resolveOnboardProject = async (options) => {
+    try {
+        const apiToken = await (0, client_1.resolveApiTokenWithOAuth)({
+            apiToken: options.apiToken,
+            enableOAuthLogin: true,
+        });
+        const client = await (0, client_1.createClientWithOAuth)({
+            apiToken: options.apiToken,
+            enableOAuthLogin: true,
+        });
+        // Project-scoped API tokens already pin a single project.
+        if (apiToken && !(0, client_1.isOAuthJwt)(apiToken)) {
+            return await (0, client_1.getProject)(client);
+        }
+        const selectedId = await selectOAuthProjectId({
+            client,
+            project: options.project,
+        });
+        if (!selectedId) {
+            return null;
+        }
+        return await (0, client_1.getProject)(client, selectedId);
+    }
+    catch (error) {
+        if (error instanceof cli_user_error_1.CliUserError) {
+            throw error;
+        }
+        console.log(chalk_1.default.yellow("Could not resolve a Meticulous project from your login (continuing with local git context only)."));
+        console.log(chalk_1.default.dim(error instanceof Error ? `  ${error.message}` : `  ${String(error)}`));
+        return null;
+    }
+};
+exports.resolveOnboardProject = resolveOnboardProject;
+const selectOAuthProjectId = async (options) => {
+    const { client, project } = options;
+    if (project) {
+        const stored = await (0, client_1.setOAuthDefaultProject)(client, project.trim());
+        if (!stored.projectId) {
+            throw new cli_user_error_1.CliUserError(`Could not resolve project '${project.trim()}'. Pass an organization/name slug or project id.`);
+        }
+        console.log(chalk_1.default.dim(`  Using project: ${(0, select_project_1.formatProjectSlug)(stored)}`));
+        return stored.projectId;
+    }
+    const projects = await (0, select_project_1.fetchAccessibleProjects)(client);
+    if (projects.length === 0) {
+        throw new cli_user_error_1.CliUserError("No projects are accessible to your account. Ask an organization admin to add you to a project.");
+    }
+    if (projects.length === 1) {
+        const only = projects[0];
+        await (0, client_1.setOAuthDefaultProject)(client, only.id);
+        console.log(chalk_1.default.dim(`  Using project: ${only.organization.name}/${only.name}`));
+        return only.id;
+    }
+    if (!(0, client_1.isInteractiveContext)()) {
+        throw new cli_user_error_1.CliUserError("Multiple projects are accessible but none was selected (no interactive terminal). " +
+            "Pass `--project organization/name` to choose one.");
+    }
+    const selected = await promptForOnboardProject(client, projects);
+    await (0, client_1.setOAuthDefaultProject)(client, selected.id);
+    return selected.id;
+};
+const promptForOnboardProject = async (client, projects) => {
+    const existing = await (0, client_1.getOAuthDefaultProject)(client).catch(() => ({
+        projectId: null,
+    }));
+    return (0, select_project_1.promptForProject)(projects, {
+        message: "Which Meticulous project are you onboarding?",
+        defaultProjectId: existing.projectId,
+    });
+};
+//# sourceMappingURL=resolve-project.js.map
+//# debugId=f160cb06-1427-52cc-8b70-5fb6d2b32d44

package/dist/commands/onboard/resolve-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-project.js","sources":["../../../src/commands/onboard/resolve-project.ts"],"sourceRoot":"","names":[],"mappings":";;;;;;;;AACA,qDAQkC;AAElC,kDAA0B;AAC1B,+DAA0D;AAC1D,+DAIoC;AAEpC;;;;;;;GAOG;AACI,MAAM,qBAAqB,GAAG,KAAK,EAAE,OAG3C,EAA2B,EAAE;IAC5B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAA,iCAAwB,EAAC;YAC9C,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAqB,EAAC;YACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;QAEH,0DAA0D;QAC1D,IAAI,QAAQ,IAAI,CAAC,IAAA,mBAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO,MAAM,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC;YAC5C,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAM,IAAA,mBAAU,EAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,6BAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,MAAM,CACV,kGAAkG,CACnG,CACF,CAAC;QACF,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,GAAG,CACP,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CACrE,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AA3CW,QAAA,qBAAqB,yBA2ChC;AAEF,MAAM,oBAAoB,GAAG,KAAK,EAAE,OAGnC,EAA0B,EAAE;IAC3B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAEpC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,MAAM,IAAA,+BAAsB,EAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,6BAAY,CACpB,8BAA8B,OAAO,CAAC,IAAI,EAAE,kDAAkD,CAC/F,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,oBAAoB,IAAA,kCAAiB,EAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC,SAAS,CAAC;IAC1B,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAA,wCAAuB,EAAC,MAAM,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,6BAAY,CACpB,gGAAgG,CACjG,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,IAAA,+BAAsB,EAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CACT,eAAK,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CACrE,CAAC;QACF,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,IAAA,6BAAoB,GAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,6BAAY,CACpB,oFAAoF;YAClF,mDAAmD,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,IAAA,+BAAsB,EAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,uBAAuB,GAAG,KAAK,EACnC,MAAwB,EACxB,QAAwB,EACD,EAAE;IACzB,MAAM,QAAQ,GAAG,MAAM,IAAA,+BAAsB,EAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACjE,SAAS,EAAE,IAAqB;KACjC,CAAC,CAAC,CAAC;IAEJ,OAAO,IAAA,iCAAgB,EAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,8CAA8C;QACvD,gBAAgB,EAAE,QAAQ,CAAC,SAAS;KACrC,CAAC,CAAC;AACL,CAAC,CAAC","debugId":"f160cb06-1427-52cc-8b70-5fb6d2b32d44"}

package/dist/commands/onboard/safe-repo-fs.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Resolves `projectRoot` to its real path. Call once at the start of onboard
+ * writes so subsequent checks share the same root.
+ */
+export declare const resolveRealProjectRoot: (projectRoot: string) => string;
+/**
+ * Resolves a repo-relative path for writing under `projectRoot`.
+ *
+ * Rejects absolute paths, `..` escapes, and any existing symlink on the path
+ * from the project root to the target (inclusive). That stops a
+ * repository-seeded symlink such as `.meticulous-onboard` → `~/.ssh` from
+ * redirecting onboard writes outside the repo.
+ */
+export declare const resolveSafeWritePath: (projectRoot: string, relativePath: string) => string;
+export declare const mkdirSafeSync: (projectRoot: string, relativePath: string) => string;
+export declare const writeFileSafeSync: (projectRoot: string, relativePath: string, data: string | NodeJS.ArrayBufferView) => string;
+export declare const copyFileSafeSync: (projectRoot: string, relativePath: string, sourceAbsolutePath: string) => string;
+/**
+ * Asserts that `workspaceDir` is the onboard workspace under `projectRoot`
+ * (or a realpath-equivalent path inside it), not an escaped location.
+ */
+export declare const assertWorkspaceInsideProject: (projectRoot: string, workspaceDir: string) => string;
+export declare const normalizeRelativeRepoPath: (relativePath: string) => string;
+export declare const isPathInsideRoot: (root: string, candidate: string) => boolean;
+/**
+ * True when `absolutePath` is a real (non-symlink) directory whose realpath
+ * stays inside the project root. Used by app discovery so a repo-seeded
+ * symlink cannot be selected as an onboard target.
+ */
+export declare const isRealDirectoryInsideProject: (projectRoot: string, absolutePath: string) => boolean;
+/**
+ * Paths the skills installer may create or write under. We must reject
+ * repo-seeded symlinks here *before* handing control to the external
+ * installer — validating only `.claude` is not enough.
+ */
+export declare const SKILLS_INSTALL_DIR_ROOTS: readonly [".claude", ".agents", ".cursor"];
+export declare const SKILLS_INSTALL_FILE_TARGETS: readonly ["skills-lock.json"];
+/**
+ * Rejects symlinks on every path the skills installer may write through, then
+ * creates the destination directory roots as real directories inside the repo.
+ * Also walks any pre-existing nested entries under each agent's skills tree —
+ * a real `skills` dir with a last-component symlink like
+ * `.claude/skills/<name> -> ~/.ssh` would otherwise let the installer write
+ * outside the project while the shallow check still passes.
+ */
+export declare const prepareSafeSkillsInstallTargets: (projectRoot: string) => void;
+/**
+ * Re-checks skills install destinations after an external installer runs, so a
+ * TOCTOU symlink plant during the install cannot go unnoticed — including
+ * nested last-component symlinks under each agent's skills tree.
+ */
+export declare const assertSafeSkillsInstallTargets: (projectRoot: string) => void;
+/**
+ * Recursively rejects any symlink under `.claude/skills`, `.agents/skills`,
+ * and `.cursor/skills`. Matches `resolveSafeWritePath`: any symlink is refused,
+ * not only ones that currently resolve outside the repo.
+ */
+export declare const assertNoSymlinksUnderSkillsTrees: (projectRoot: string) => void;
+//# sourceMappingURL=safe-repo-fs.d.ts.map

package/dist/commands/onboard/safe-repo-fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-repo-fs.d.ts","sourceRoot":"","sources":["../../../src/commands/onboard/safe-repo-fs.ts"],"names":[],"mappings":"AAoBA;;;GAGG;AACH,eAAO,MAAM,sBAAsB,gBAAiB,MAAM,KAAG,MAW5D,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,gBAClB,MAAM,gBACL,MAAM,KACnB,MAmDF,CAAC;AAEF,eAAO,MAAM,aAAa,gBACX,MAAM,gBACL,MAAM,KACnB,MAOF,CAAC;AAEF,eAAO,MAAM,iBAAiB,gBACf,MAAM,gBACL,MAAM,QACd,MAAM,GAAG,MAAM,CAAC,eAAe,KACpC,MAUF,CAAC;AAEF,eAAO,MAAM,gBAAgB,gBACd,MAAM,gBACL,MAAM,sBACA,MAAM,KACzB,MAQF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,4BAA4B,gBAC1B,MAAM,gBACL,MAAM,KACnB,MAiBF,CAAC;AAMF,eAAO,MAAM,yBAAyB,iBAAkB,MAAM,KAAG,MAgBhE,CAAC;AAEF,eAAO,MAAM,gBAAgB,SAAU,MAAM,aAAa,MAAM,KAAG,OAQlE,CAAC;AAUF;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,gBAC1B,MAAM,gBACL,MAAM,KACnB,OAaF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,4CAI3B,CAAC;AAEX,eAAO,MAAM,2BAA2B,+BAAgC,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,gBAAiB,MAAM,KAAG,IAYrE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,gBAAiB,MAAM,KAAG,IASpE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,gBAAiB,MAAM,KAAG,IAOtE,CAAC"}

package/dist/commands/onboard/safe-repo-fs.js

@@ -0,0 +1,266 @@
+"use strict";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="96da1693-9282-57e0-8720-eb64652df868")}catch(e){}}();
+
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertNoSymlinksUnderSkillsTrees = exports.assertSafeSkillsInstallTargets = exports.prepareSafeSkillsInstallTargets = exports.SKILLS_INSTALL_FILE_TARGETS = exports.SKILLS_INSTALL_DIR_ROOTS = exports.isRealDirectoryInsideProject = exports.isPathInsideRoot = exports.normalizeRelativeRepoPath = exports.assertWorkspaceInsideProject = exports.copyFileSafeSync = exports.writeFileSafeSync = exports.mkdirSafeSync = exports.resolveSafeWritePath = exports.resolveRealProjectRoot = void 0;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const cli_user_error_1 = require("../../utils/cli-user-error");
+/**
+ * Resolves `projectRoot` to its real path. Call once at the start of onboard
+ * writes so subsequent checks share the same root.
+ */
+const resolveRealProjectRoot = (projectRoot) => {
+    const absolute = (0, path_1.resolve)(projectRoot);
+    if (!(0, fs_1.existsSync)(absolute)) {
+        throw new cli_user_error_1.CliUserError(`Project root does not exist: ${absolute}`);
+    }
+    const stat = (0, fs_1.lstatSync)(absolute);
+    if (stat.isSymbolicLink()) {
+        // Allow the root itself to be reached via a symlink (e.g. worktrees), but
+        // still pin writes to the real directory.
+    }
+    return (0, fs_1.realpathSync)(absolute);
+};
+exports.resolveRealProjectRoot = resolveRealProjectRoot;
+/**
+ * Resolves a repo-relative path for writing under `projectRoot`.
+ *
+ * Rejects absolute paths, `..` escapes, and any existing symlink on the path
+ * from the project root to the target (inclusive). That stops a
+ * repository-seeded symlink such as `.meticulous-onboard` → `~/.ssh` from
+ * redirecting onboard writes outside the repo.
+ */
+const resolveSafeWritePath = (projectRoot, relativePath) => {
+    const realRoot = (0, exports.resolveRealProjectRoot)(projectRoot);
+    const normalizedRelative = (0, exports.normalizeRelativeRepoPath)(relativePath);
+    const parts = normalizedRelative
+        .split("/")
+        .filter((part) => part.length > 0 && part !== ".");
+    let current = realRoot;
+    for (let index = 0; index < parts.length; index++) {
+        const next = (0, path_1.join)(current, parts[index]);
+        const stat = tryLstat(next);
+        if (!stat) {
+            current = (0, path_1.join)(current, ...parts.slice(index));
+            break;
+        }
+        // Use lstat (not existsSync) so broken symlinks are still rejected.
+        if (stat.isSymbolicLink()) {
+            const display = parts.slice(0, index + 1).join("/");
+            throw new cli_user_error_1.CliUserError(`Refusing to write through symlink at '${display}'. ` +
+                `Remove or replace it, then re-run \`meticulous onboard\`.`);
+        }
+        if (stat.isDirectory()) {
+            current = (0, fs_1.realpathSync)(next);
+            if (!(0, exports.isPathInsideRoot)(realRoot, current)) {
+                throw new cli_user_error_1.CliUserError(`Refusing to write outside the project root via '${parts.slice(0, index + 1).join("/")}'.`);
+            }
+            continue;
+        }
+        // Existing non-directory leaf (regular file, etc.): must be the final part.
+        if (index !== parts.length - 1) {
+            throw new cli_user_error_1.CliUserError(`Refusing to write under non-directory path '${parts.slice(0, index + 1).join("/")}'.`);
+        }
+        current = next;
+    }
+    if (!(0, exports.isPathInsideRoot)(realRoot, current)) {
+        throw new cli_user_error_1.CliUserError(`Refusing to write outside the project root: ${relativePath}`);
+    }
+    return current;
+};
+exports.resolveSafeWritePath = resolveSafeWritePath;
+const mkdirSafeSync = (projectRoot, relativePath) => {
+    const absolute = (0, exports.resolveSafeWritePath)(projectRoot, relativePath);
+    (0, fs_1.mkdirSync)(absolute, { recursive: true });
+    // Re-check after create: a race could theoretically replace a component, but
+    // more importantly ensure we didn't land on a symlink somehow.
+    assertNoSymlinkAt(projectRoot, relativePath);
+    return absolute;
+};
+exports.mkdirSafeSync = mkdirSafeSync;
+const writeFileSafeSync = (projectRoot, relativePath, data) => {
+    (0, exports.resolveSafeWritePath)(projectRoot, relativePath);
+    const parentRelative = (0, path_1.dirname)((0, exports.normalizeRelativeRepoPath)(relativePath));
+    if (parentRelative !== "." && parentRelative !== "") {
+        (0, exports.mkdirSafeSync)(projectRoot, parentRelative);
+    }
+    // Re-resolve after parents exist so a symlink planted on a parent is caught.
+    const target = (0, exports.resolveSafeWritePath)(projectRoot, relativePath);
+    (0, fs_1.writeFileSync)(target, data);
+    return target;
+};
+exports.writeFileSafeSync = writeFileSafeSync;
+const copyFileSafeSync = (projectRoot, relativePath, sourceAbsolutePath) => {
+    const parentRelative = (0, path_1.dirname)((0, exports.normalizeRelativeRepoPath)(relativePath));
+    if (parentRelative !== "." && parentRelative !== "") {
+        (0, exports.mkdirSafeSync)(projectRoot, parentRelative);
+    }
+    const target = (0, exports.resolveSafeWritePath)(projectRoot, relativePath);
+    (0, fs_1.copyFileSync)(sourceAbsolutePath, target);
+    return target;
+};
+exports.copyFileSafeSync = copyFileSafeSync;
+/**
+ * Asserts that `workspaceDir` is the onboard workspace under `projectRoot`
+ * (or a realpath-equivalent path inside it), not an escaped location.
+ */
+const assertWorkspaceInsideProject = (projectRoot, workspaceDir) => {
+    const realRoot = (0, exports.resolveRealProjectRoot)(projectRoot);
+    if (!(0, fs_1.existsSync)(workspaceDir)) {
+        throw new cli_user_error_1.CliUserError(`Onboard workspace does not exist: ${workspaceDir}`);
+    }
+    if ((0, fs_1.lstatSync)(workspaceDir).isSymbolicLink()) {
+        throw new cli_user_error_1.CliUserError(`Refusing to use symlink onboard workspace at '${workspaceDir}'.`);
+    }
+    const realWorkspace = (0, fs_1.realpathSync)(workspaceDir);
+    if (!(0, exports.isPathInsideRoot)(realRoot, realWorkspace)) {
+        throw new cli_user_error_1.CliUserError(`Onboard workspace escapes the project root: ${workspaceDir}`);
+    }
+    return realWorkspace;
+};
+exports.assertWorkspaceInsideProject = assertWorkspaceInsideProject;
+const assertNoSymlinkAt = (projectRoot, relativePath) => {
+    (0, exports.resolveSafeWritePath)(projectRoot, relativePath);
+};
+const normalizeRelativeRepoPath = (relativePath) => {
+    if (relativePath.length === 0 || relativePath === ".") {
+        throw new cli_user_error_1.CliUserError("Refusing empty write path under the project root.");
+    }
+    if ((0, path_1.isAbsolute)(relativePath)) {
+        throw new cli_user_error_1.CliUserError(`Refusing absolute write path: ${relativePath}`);
+    }
+    const normalized = (0, path_1.normalize)(relativePath).replace(/\\/g, "/");
+    if (normalized === ".." ||
+        normalized.startsWith("../") ||
+        normalized.split("/").includes("..")) {
+        throw new cli_user_error_1.CliUserError(`Refusing path escape: ${relativePath}`);
+    }
+    return normalized.replace(/^\.\//u, "");
+};
+exports.normalizeRelativeRepoPath = normalizeRelativeRepoPath;
+const isPathInsideRoot = (root, candidate) => {
+    const relativeToRoot = (0, path_1.relative)(root, candidate);
+    return (relativeToRoot === "" ||
+        (!relativeToRoot.startsWith(`..${path_1.sep}`) &&
+            relativeToRoot !== ".." &&
+            !(0, path_1.isAbsolute)(relativeToRoot)));
+};
+exports.isPathInsideRoot = isPathInsideRoot;
+const tryLstat = (path) => {
+    try {
+        return (0, fs_1.lstatSync)(path);
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * True when `absolutePath` is a real (non-symlink) directory whose realpath
+ * stays inside the project root. Used by app discovery so a repo-seeded
+ * symlink cannot be selected as an onboard target.
+ */
+const isRealDirectoryInsideProject = (projectRoot, absolutePath) => {
+    const realRoot = (0, exports.resolveRealProjectRoot)(projectRoot);
+    const stat = tryLstat(absolutePath);
+    if (!stat || stat.isSymbolicLink() || !stat.isDirectory()) {
+        return false;
+    }
+    let realCandidate;
+    try {
+        realCandidate = (0, fs_1.realpathSync)(absolutePath);
+    }
+    catch {
+        return false;
+    }
+    return (0, exports.isPathInsideRoot)(realRoot, realCandidate);
+};
+exports.isRealDirectoryInsideProject = isRealDirectoryInsideProject;
+/**
+ * Paths the skills installer may create or write under. We must reject
+ * repo-seeded symlinks here *before* handing control to the external
+ * installer — validating only `.claude` is not enough.
+ */
+exports.SKILLS_INSTALL_DIR_ROOTS = [
+    ".claude",
+    ".agents",
+    ".cursor",
+];
+exports.SKILLS_INSTALL_FILE_TARGETS = ["skills-lock.json"];
+/**
+ * Rejects symlinks on every path the skills installer may write through, then
+ * creates the destination directory roots as real directories inside the repo.
+ * Also walks any pre-existing nested entries under each agent's skills tree —
+ * a real `skills` dir with a last-component symlink like
+ * `.claude/skills/<name> -> ~/.ssh` would otherwise let the installer write
+ * outside the project while the shallow check still passes.
+ */
+const prepareSafeSkillsInstallTargets = (projectRoot) => {
+    for (const file of exports.SKILLS_INSTALL_FILE_TARGETS) {
+        // Throws if the path (or any parent component) is a symlink.
+        (0, exports.resolveSafeWritePath)(projectRoot, file);
+    }
+    for (const dir of exports.SKILLS_INSTALL_DIR_ROOTS) {
+        (0, exports.mkdirSafeSync)(projectRoot, dir);
+        (0, exports.mkdirSafeSync)(projectRoot, (0, path_1.join)(dir, "skills"));
+    }
+    (0, exports.assertNoSymlinksUnderSkillsTrees)(projectRoot);
+};
+exports.prepareSafeSkillsInstallTargets = prepareSafeSkillsInstallTargets;
+/**
+ * Re-checks skills install destinations after an external installer runs, so a
+ * TOCTOU symlink plant during the install cannot go unnoticed — including
+ * nested last-component symlinks under each agent's skills tree.
+ */
+const assertSafeSkillsInstallTargets = (projectRoot) => {
+    for (const file of exports.SKILLS_INSTALL_FILE_TARGETS) {
+        (0, exports.resolveSafeWritePath)(projectRoot, file);
+    }
+    for (const dir of exports.SKILLS_INSTALL_DIR_ROOTS) {
+        (0, exports.resolveSafeWritePath)(projectRoot, dir);
+        (0, exports.resolveSafeWritePath)(projectRoot, (0, path_1.join)(dir, "skills"));
+    }
+    (0, exports.assertNoSymlinksUnderSkillsTrees)(projectRoot);
+};
+exports.assertSafeSkillsInstallTargets = assertSafeSkillsInstallTargets;
+/**
+ * Recursively rejects any symlink under `.claude/skills`, `.agents/skills`,
+ * and `.cursor/skills`. Matches `resolveSafeWritePath`: any symlink is refused,
+ * not only ones that currently resolve outside the repo.
+ */
+const assertNoSymlinksUnderSkillsTrees = (projectRoot) => {
+    const realRoot = (0, exports.resolveRealProjectRoot)(projectRoot);
+    for (const dir of exports.SKILLS_INSTALL_DIR_ROOTS) {
+        const relativeSkills = (0, path_1.join)(dir, "skills").replace(/\\/g, "/");
+        const absoluteSkills = (0, path_1.join)(realRoot, dir, "skills");
+        assertNoSymlinksUnderDirectory(absoluteSkills, relativeSkills);
+    }
+};
+exports.assertNoSymlinksUnderSkillsTrees = assertNoSymlinksUnderSkillsTrees;
+const assertNoSymlinksUnderDirectory = (absoluteDir, relativeDisplay) => {
+    const dirStat = tryLstat(absoluteDir);
+    if (!dirStat) {
+        return;
+    }
+    if (dirStat.isSymbolicLink()) {
+        throw new cli_user_error_1.CliUserError(`Refusing to write through symlink at '${relativeDisplay}'. ` +
+            `Remove or replace it, then re-run \`meticulous onboard\`.`);
+    }
+    if (!dirStat.isDirectory()) {
+        return;
+    }
+    for (const entry of (0, fs_1.readdirSync)(absoluteDir, { withFileTypes: true })) {
+        const childRelative = `${relativeDisplay}/${entry.name}`;
+        // Check symlink before isDirectory(): a symlink-to-dir can report as both
+        // depending on platform / Node version.
+        if (entry.isSymbolicLink()) {
+            throw new cli_user_error_1.CliUserError(`Refusing to write through symlink at '${childRelative}'. ` +
+                `Remove or replace it, then re-run \`meticulous onboard\`.`);
+        }
+        if (entry.isDirectory()) {
+            assertNoSymlinksUnderDirectory((0, path_1.join)(absoluteDir, entry.name), childRelative);
+        }
+    }
+};
+//# sourceMappingURL=safe-repo-fs.js.map
+//# debugId=96da1693-9282-57e0-8720-eb64652df868

package/dist/commands/onboard/safe-repo-fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-repo-fs.js","sources":["../../../src/commands/onboard/safe-repo-fs.ts"],"sourceRoot":"","names":[],"mappings":";;;;;AAAA,2BAQY;AACZ,+BAQc;AACd,+DAA0D;AAE1D;;;GAGG;AACI,MAAM,sBAAsB,GAAG,CAAC,WAAmB,EAAU,EAAE;IACpE,MAAM,QAAQ,GAAG,IAAA,cAAO,EAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,IAAA,eAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,6BAAY,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,cAAS,EAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,0CAA0C;IAC5C,CAAC;IACD,OAAO,IAAA,iBAAY,EAAC,QAAQ,CAAC,CAAC;AAChC,CAAC,CAAC;AAXW,QAAA,sBAAsB,0BAWjC;AAEF;;;;;;;GAOG;AACI,MAAM,oBAAoB,GAAG,CAClC,WAAmB,EACnB,YAAoB,EACZ,EAAE;IACV,MAAM,QAAQ,GAAG,IAAA,8BAAsB,EAAC,WAAW,CAAC,CAAC;IACrD,MAAM,kBAAkB,GAAG,IAAA,iCAAyB,EAAC,YAAY,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,kBAAkB;SAC7B,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC;IAErD,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAA,WAAI,EAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,IAAA,WAAI,EAAC,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/C,MAAM;QACR,CAAC;QAED,oEAAoE;QACpE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpD,MAAM,IAAI,6BAAY,CACpB,yCAAyC,OAAO,KAAK;gBACnD,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,OAAO,GAAG,IAAA,iBAAY,EAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAA,wBAAgB,EAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,6BAAY,CACpB,mDAAmD,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAC3F,CAAC;YACJ,CAAC;YACD,SAAS;QACX,CAAC;QAED,4EAA4E;QAC5E,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,6BAAY,CACpB,+CAA+C,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CACvF,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,IAAA,wBAAgB,EAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,6BAAY,CACpB,+CAA+C,YAAY,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAtDW,QAAA,oBAAoB,wBAsD/B;AAEK,MAAM,aAAa,GAAG,CAC3B,WAAmB,EACnB,YAAoB,EACZ,EAAE;IACV,MAAM,QAAQ,GAAG,IAAA,4BAAoB,EAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACjE,IAAA,cAAS,EAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,6EAA6E;IAC7E,+DAA+D;IAC/D,iBAAiB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC7C,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAVW,QAAA,aAAa,iBAUxB;AAEK,MAAM,iBAAiB,GAAG,CAC/B,WAAmB,EACnB,YAAoB,EACpB,IAAqC,EAC7B,EAAE;IACV,IAAA,4BAAoB,EAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,IAAA,cAAO,EAAC,IAAA,iCAAyB,EAAC,YAAY,CAAC,CAAC,CAAC;IACxE,IAAI,cAAc,KAAK,GAAG,IAAI,cAAc,KAAK,EAAE,EAAE,CAAC;QACpD,IAAA,qBAAa,EAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC7C,CAAC;IACD,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAA,4BAAoB,EAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC/D,IAAA,kBAAa,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAdW,QAAA,iBAAiB,qBAc5B;AAEK,MAAM,gBAAgB,GAAG,CAC9B,WAAmB,EACnB,YAAoB,EACpB,kBAA0B,EAClB,EAAE;IACV,MAAM,cAAc,GAAG,IAAA,cAAO,EAAC,IAAA,iCAAyB,EAAC,YAAY,CAAC,CAAC,CAAC;IACxE,IAAI,cAAc,KAAK,GAAG,IAAI,cAAc,KAAK,EAAE,EAAE,CAAC;QACpD,IAAA,qBAAa,EAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,4BAAoB,EAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC/D,IAAA,iBAAY,EAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAZW,QAAA,gBAAgB,oBAY3B;AAEF;;;GAGG;AACI,MAAM,4BAA4B,GAAG,CAC1C,WAAmB,EACnB,YAAoB,EACZ,EAAE;IACV,MAAM,QAAQ,GAAG,IAAA,8BAAsB,EAAC,WAAW,CAAC,CAAC;IACrD,IAAI,CAAC,IAAA,eAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,6BAAY,CAAC,qCAAqC,YAAY,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,IAAA,cAAS,EAAC,YAAY,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,6BAAY,CACpB,iDAAiD,YAAY,IAAI,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,IAAA,iBAAY,EAAC,YAAY,CAAC,CAAC;IACjD,IAAI,CAAC,IAAA,wBAAgB,EAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,6BAAY,CACpB,+CAA+C,YAAY,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC,CAAC;AApBW,QAAA,4BAA4B,gCAoBvC;AAEF,MAAM,iBAAiB,GAAG,CAAC,WAAmB,EAAE,YAAoB,EAAQ,EAAE;IAC5E,IAAA,4BAAoB,EAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AAClD,CAAC,CAAC;AAEK,MAAM,yBAAyB,GAAG,CAAC,YAAoB,EAAU,EAAE;IACxE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;QACtD,MAAM,IAAI,6BAAY,CAAC,mDAAmD,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,IAAA,iBAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,6BAAY,CAAC,iCAAiC,YAAY,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,UAAU,GAAG,IAAA,gBAAS,EAAC,YAAY,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/D,IACE,UAAU,KAAK,IAAI;QACnB,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EACpC,CAAC;QACD,MAAM,IAAI,6BAAY,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC,CAAC;AAhBW,QAAA,yBAAyB,6BAgBpC;AAEK,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,SAAiB,EAAW,EAAE;IAC3E,MAAM,cAAc,GAAG,IAAA,eAAQ,EAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjD,OAAO,CACL,cAAc,KAAK,EAAE;QACrB,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,KAAK,UAAG,EAAE,CAAC;YACrC,cAAc,KAAK,IAAI;YACvB,CAAC,IAAA,iBAAU,EAAC,cAAc,CAAC,CAAC,CAC/B,CAAC;AACJ,CAAC,CAAC;AARW,QAAA,gBAAgB,oBAQ3B;AAEF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE;IAChC,IAAI,CAAC;QACH,OAAO,IAAA,cAAS,EAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF;;;;GAIG;AACI,MAAM,4BAA4B,GAAG,CAC1C,WAAmB,EACnB,YAAoB,EACX,EAAE;IACX,MAAM,QAAQ,GAAG,IAAA,8BAAsB,EAAC,WAAW,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,IAAA,iBAAY,EAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAA,wBAAgB,EAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACnD,CAAC,CAAC;AAhBW,QAAA,4BAA4B,gCAgBvC;AAEF;;;;GAIG;AACU,QAAA,wBAAwB,GAAG;IACtC,SAAS;IACT,SAAS;IACT,SAAS;CACD,CAAC;AAEE,QAAA,2BAA2B,GAAG,CAAC,kBAAkB,CAAU,CAAC;AAEzE;;;;;;;GAOG;AACI,MAAM,+BAA+B,GAAG,CAAC,WAAmB,EAAQ,EAAE;IAC3E,KAAK,MAAM,IAAI,IAAI,mCAA2B,EAAE,CAAC;QAC/C,6DAA6D;QAC7D,IAAA,4BAAoB,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,gCAAwB,EAAE,CAAC;QAC3C,IAAA,qBAAa,EAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAChC,IAAA,qBAAa,EAAC,WAAW,EAAE,IAAA,WAAI,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,IAAA,wCAAgC,EAAC,WAAW,CAAC,CAAC;AAChD,CAAC,CAAC;AAZW,QAAA,+BAA+B,mCAY1C;AAEF;;;;GAIG;AACI,MAAM,8BAA8B,GAAG,CAAC,WAAmB,EAAQ,EAAE;IAC1E,KAAK,MAAM,IAAI,IAAI,mCAA2B,EAAE,CAAC;QAC/C,IAAA,4BAAoB,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,gCAAwB,EAAE,CAAC;QAC3C,IAAA,4BAAoB,EAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACvC,IAAA,4BAAoB,EAAC,WAAW,EAAE,IAAA,WAAI,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAA,wCAAgC,EAAC,WAAW,CAAC,CAAC;AAChD,CAAC,CAAC;AATW,QAAA,8BAA8B,kCASzC;AAEF;;;;GAIG;AACI,MAAM,gCAAgC,GAAG,CAAC,WAAmB,EAAQ,EAAE;IAC5E,MAAM,QAAQ,GAAG,IAAA,8BAAsB,EAAC,WAAW,CAAC,CAAC;IACrD,KAAK,MAAM,GAAG,IAAI,gCAAwB,EAAE,CAAC;QAC3C,MAAM,cAAc,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,IAAA,WAAI,EAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrD,8BAA8B,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC;AAPW,QAAA,gCAAgC,oCAO3C;AAEF,MAAM,8BAA8B,GAAG,CACrC,WAAmB,EACnB,eAAuB,EACjB,EAAE;IACR,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,6BAAY,CACpB,yCAAyC,eAAe,KAAK;YAC3D,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3B,OAAO;IACT,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,IAAA,gBAAW,EAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,aAAa,GAAG,GAAG,eAAe,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACzD,0EAA0E;QAC1E,wCAAwC;QACxC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,6BAAY,CACpB,yCAAyC,aAAa,KAAK;gBACzD,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,8BAA8B,CAC5B,IAAA,WAAI,EAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,EAC7B,aAAa,CACd,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC","debugId":"96da1693-9282-57e0-8720-eb64652df868"}