@bike4mind/cli 3.3.0 → 4.0.0

package/dist/commands/skillsCommand.mjs

@@ -0,0 +1,259 @@
+#!/usr/bin/env node
+import { nn as splitSkillMdFrontmatter, p as requireApiUrl, t as ConfigStore, tn as readSkillMdSourceUrl } from "../ConfigStore-BwqsQ0U9.mjs";
+import { r as isReservedCommandName, t as RemoteSkillSource } from "../RemoteSkillSource-qTvRkaNA.mjs";
+import { t as ApiClient } from "../ApiClient-_JrM_xWw.mjs";
+import { promises } from "fs";
+import os from "os";
+import path from "path";
+import { createInterface } from "readline";
+import YAML from "yaml";
+const THIRD_PARTY_LINE = new RegExp(`^\\s*#\\s*Third-party skill from the Bike4Mind Skill Market - review before use`, "m");
+const ARGUMENT_HINT_LINE = /^(argument-hint:[ \t]*)([^\r\n]+?)[ \t]*$/gm;
+function quoteRawArgumentHint(frontmatter) {
+	return frontmatter.replace(ARGUMENT_HINT_LINE, (line, key, raw) => {
+		if (/^["'|>]/.test(raw)) return line;
+		const hint = (raw.startsWith("[") || raw.startsWith("<") ? raw.replace(/([\]>])[ \t]+#.*$/, "$1") : raw.replace(/[ \t]+#.*$/, "")).trimEnd();
+		return hint.startsWith("[") || hint.startsWith("<") || hint.includes(": ") ? `${key}${JSON.stringify(hint)}` : line;
+	});
+}
+const toText = (value) => typeof value === "string" || typeof value === "number" || typeof value === "boolean" ? String(value) : void 0;
+/** Parses a SKILL.md into skill form fields. Never throws; a malformed file yields `ok: false`. */
+function parseSkillMd(input) {
+	const text = input.replace(/\r\n?/g, "\n");
+	const split = splitSkillMdFrontmatter(text);
+	if (!split) {
+		if (/^\uFEFF?---/.test(text)) return {
+			ok: false,
+			error: "The frontmatter block has no closing --- line."
+		};
+		return {
+			ok: true,
+			fields: { body: stripBodyNewlines(text.replace(/^\uFEFF/, "")) },
+			dropped: []
+		};
+	}
+	if (split.lang && split.lang !== "yaml" && split.lang !== "yml") return {
+		ok: false,
+		error: `Unsupported frontmatter language "${split.lang}"; only YAML is supported.`
+	};
+	let data;
+	try {
+		const frontmatter = quoteRawArgumentHint(split.frontmatter);
+		data = YAML.parse(frontmatter) ?? {};
+	} catch (error) {
+		return {
+			ok: false,
+			error: `Invalid YAML frontmatter: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+	if (typeof data !== "object" || data === null || Array.isArray(data)) return {
+		ok: false,
+		error: "The frontmatter must be a set of key: value pairs."
+	};
+	const fields = { body: stripBodyNewlines(split.rest) };
+	const dropped = [];
+	for (const [key, value] of Object.entries(data)) switch (key) {
+		case "name":
+			fields.name = toText(value);
+			break;
+		case "description":
+			fields.description = toText(value);
+			break;
+		case "argument-hint":
+			fields.argumentHint = toText(value);
+			break;
+		case "disable-model-invocation":
+			fields.disableModelInvocation = fields.disableModelInvocation || value === true || value === "true";
+			break;
+		case "autoinvoke":
+			fields.disableModelInvocation = fields.disableModelInvocation || value === false || value === "false";
+			break;
+		default: dropped.push(key);
+	}
+	const url = readSkillMdSourceUrl(split.frontmatter);
+	return {
+		ok: true,
+		fields: Object.fromEntries(Object.entries(fields).filter(([, v]) => v !== void 0)),
+		dropped,
+		...url !== void 0 && { source: {
+			url,
+			thirdParty: THIRD_PARTY_LINE.test(split.frontmatter)
+		} }
+	};
+}
+/** Drops the blank line after the closing fence and the single trailing newline toSkillMd adds. */
+function stripBodyNewlines(rest) {
+	return rest.replace(/^\r?\n/, "").replace(/\r?\n$/, "");
+}
+//#endregion
+//#region src/commands/skillsCommand.ts
+/**
+* External skills command (b4m skills push <path>).
+* Imports a Claude Code SKILL.md (or commands/*.md) as the user's own
+* Bike4Mind skill. Runs outside the interactive CLI session. Validation is
+* left to the server (apps/client/server/utils/skillValidation.ts).
+*/
+const MAX_LISTED_FILES = 10;
+const DESCRIPTION_MAX = 500;
+/** The server requires a description, but many Claude Code commands/*.md files have none. */
+function descriptionFor(fields) {
+	if (fields.description?.trim()) return fields.description;
+	return ((fields.body ?? "").split("\n").map((line) => line.replace(/^#+\s*/, "").trim()).find(Boolean) ?? "").slice(0, DESCRIPTION_MAX);
+}
+/**
+* Built from an explicit field list (never a spread of parsed data) so
+* allowedTools can't reach the server: Claude Code tool names don't map to B4M.
+* disableModelInvocation is always sent so an update mirrors the file.
+*/
+function buildSkillPayload(fields, fallbackName) {
+	return {
+		name: (fields.name?.trim() || fallbackName).trim().toLowerCase(),
+		description: descriptionFor(fields),
+		body: fields.body ?? "",
+		...fields.argumentHint !== void 0 && { argumentHint: fields.argumentHint },
+		disableModelInvocation: fields.disableModelInvocation ?? false
+	};
+}
+/** Resolves <dir>, <dir>/SKILL.md or any .md file and parses it. */
+async function readSkillFile(input) {
+	const expanded = input === "~" || input.startsWith("~/") ? path.join(os.homedir(), input.slice(1)) : input;
+	const resolved = path.resolve(expanded);
+	let stat;
+	try {
+		stat = await promises.stat(resolved);
+	} catch {
+		throw new Error(`No such file or folder: ${input}`);
+	}
+	let filePath;
+	let fallbackName;
+	if (stat.isDirectory()) {
+		filePath = path.join(resolved, "SKILL.md");
+		fallbackName = path.basename(resolved);
+	} else if (stat.isFile() && resolved.toLowerCase().endsWith(".md")) {
+		filePath = resolved;
+		fallbackName = path.basename(resolved).toLowerCase() === "skill.md" ? path.basename(path.dirname(resolved)) : path.basename(resolved, path.extname(resolved));
+	} else throw new Error(`Not a skill: ${input} - pass a skill folder, its SKILL.md, or a .md file.`);
+	let text;
+	try {
+		text = await promises.readFile(filePath, "utf8");
+	} catch {
+		throw new Error(stat.isDirectory() ? "No SKILL.md in that folder." : `Cannot read ${input}`);
+	}
+	const parsed = parseSkillMd(text);
+	if (!parsed.ok) throw new Error(parsed.error);
+	const name = path.basename(filePath);
+	const extraFiles = name.toLowerCase() === "skill.md" ? (await promises.readdir(path.dirname(filePath))).filter((f) => f !== name && !f.startsWith(".")).sort() : [];
+	return {
+		payload: buildSkillPayload(parsed.fields, fallbackName),
+		dropped: parsed.dropped,
+		...parsed.source && { source: parsed.source },
+		extraFiles
+	};
+}
+function serverMessage(error) {
+	const err = error;
+	return err?.response?.data?.error ?? err?.response?.data?.message ?? err?.message ?? String(error);
+}
+/** The stamp is plain comment text, so only a same-origin URL is presented as provenance. */
+function isSameOrigin(url, apiOrigin) {
+	try {
+		return apiOrigin !== void 0 && new URL(url).origin === new URL(apiOrigin).origin;
+	} catch {
+		return false;
+	}
+}
+/**
+* Prints the notices, applies the third-party and name-conflict gates, then
+* creates or updates the skill. Nothing is sent to the server before the
+* third-party gate passes. Throws on any exit-1 condition.
+*/
+async function pushSkill(file, deps) {
+	const { payload, dropped, source, extraFiles } = file;
+	const { api, log } = deps;
+	if (dropped.length > 0) log(`Ignored (not supported in Bike4Mind skills): ${dropped.join(", ")}`);
+	if (extraFiles.length > 0) log(`Not uploaded: supporting files (${extraFiles.slice(0, MAX_LISTED_FILES).join(", ")}${extraFiles.length > MAX_LISTED_FILES ? ` and ${extraFiles.length - MAX_LISTED_FILES} more` : ""}) - only SKILL.md is pushed.`);
+	if (isReservedCommandName(payload.name)) log(`Note: /${payload.name} is a built-in B4M CLI command, so the CLI won't list this skill (the web still will).`);
+	if (source) {
+		log(isSameOrigin(source.url, deps.apiOrigin) ? `This skill came from Bike4Mind: ${source.url}` : `This file has a Bike4Mind source stamp from another site: ${source.url}`);
+		if (source.thirdParty) {
+			log("This is another author's Skill Market skill - import it from the market instead to keep updates and attribution.");
+			if (!deps.yes) {
+				if (!deps.isTTY) throw new Error("Re-run with --yes to push another author's skill as your own.");
+				if (!await deps.confirm("Push it as your own skill anyway? [y/N] ")) return "aborted";
+			}
+		}
+	}
+	try {
+		const me = await api.getCurrentUser();
+		if (!me) throw new Error("Not authenticated. Run `b4m /login` to authenticate.");
+		let existing;
+		for (let page = 1; !existing; page++) {
+			const { data, hasMore } = await api.get("/api/skills", { params: {
+				query: payload.name,
+				limit: 100,
+				page
+			} });
+			existing = data.find((s) => s.name === payload.name && s.userId === me.id);
+			if (!hasMore) break;
+		}
+		if (!existing) {
+			await api.post("/api/skills", payload);
+			return "created";
+		}
+		if (existing.importedFrom) throw new Error(`"${payload.name}" is the name of a Skill Market skill you imported - rename the local skill or delete the import first.`);
+		if (!deps.update) {
+			if (!deps.isTTY) throw new Error(`A skill named "${payload.name}" already exists - re-run with --update to overwrite it.`);
+			if (!await deps.confirm(`A skill named "${payload.name}" already exists. Update it? [y/N] `)) return "aborted";
+		}
+		await api.put(`/api/skills/${existing.id}`, {
+			...payload,
+			argumentHint: payload.argumentHint ?? ""
+		});
+		return "updated";
+	} catch (error) {
+		throw new Error(serverMessage(error));
+	}
+}
+async function confirm(question) {
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		const answer = await new Promise((resolve) => rl.question(question, resolve));
+		return /^y(es)?$/i.test(answer.trim());
+	} finally {
+		rl.close();
+	}
+}
+async function handleSkillsCommand(subcommand, argv) {
+	if (subcommand !== "push") throw new Error(`Unknown skills subcommand: ${subcommand ?? "(none)"}`);
+	if (!argv.path) throw new Error("Usage: b4m skills push <path>");
+	const file = await readSkillFile(argv.path);
+	const configStore = new ConfigStore();
+	const config = await configStore.load();
+	if (!await configStore.getAuthTokens()) throw new Error("Not authenticated. Run `b4m /login` to authenticate.");
+	const apiUrl = requireApiUrl(config.apiConfig);
+	const apiClient = new ApiClient(apiUrl, configStore);
+	const result = await pushSkill(file, {
+		api: apiClient,
+		confirm,
+		isTTY: Boolean(process.stdin.isTTY),
+		update: Boolean(argv.update),
+		yes: Boolean(argv.yes),
+		apiOrigin: apiUrl,
+		log: (line) => console.log(line)
+	});
+	if (result === "aborted") {
+		console.log("Aborted");
+		return;
+	}
+	try {
+		await new RemoteSkillSource(apiClient).clearCache();
+	} catch (error) {
+		console.warn(`Skill saved, but the local skills cache could not be cleared: ${serverMessage(error)}`);
+	}
+	console.log(`${result === "created" ? "Created" : "Updated"} skill /${file.payload.name}`);
+}
+//#endregion
+export { buildSkillPayload, handleSkillsCommand, pushSkill, readSkillFile };

package/dist/commands/updateCommand.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as version } from "../package-DYPVrada.mjs";
+import { t as version } from "../package-CQaam4Dq.mjs";
 import { a as forceCheckForUpdate, c as isNpmPrefixWritable, d as shouldAttemptAutoUpdate, l as readCachedUpdate, n as REEXEC_GUARD_ENV, o as getAutoUpdatePreference, t as INSTALL_CMD, u as setAutoUpdatePreference } from "../updateChecker-CCLVVdH0.mjs";
 import { t as checkRipgrep } from "../ripgrepCheck-BmkyTK2i.mjs";
 import { execSync, spawnSync } from "child_process";

package/dist/{dist-DPP7UmK9.mjs → dist-Ul2qwn5x.mjs}

@@ -1,136 +1,5 @@
 #!/usr/bin/env node
-import { b as logger, g as DeviceFlowClient, h as AuthenticatedApiClient, t as ConfigStore } from "./ConfigStore-DUATzLxB.mjs";
-import { t as version } from "./package-DYPVrada.mjs";
-import { isAxiosError } from "axios";
-import { Readable } from "node:stream";
 import { createParser } from "eventsource-parser";
-//#region src/auth/OAuthClient.ts
-/**
-* The CLI's RFC 8628 `client_id`; the desktop app registers under its own. Typed against the
-* server allowlist so dropping this id there fails this build rather than this client's logins
-* (see OAUTH_DEVICE_CLIENT_IDS).
-*/
-const CLI_OAUTH_CLIENT_ID = "b4m-cli";
-/**
-* The shared device-flow client, pinned to the CLI's registration.
-*/
-var OAuthClient = class extends DeviceFlowClient {
-	constructor(baseURL = "http://localhost:3000") {
-		super({
-			baseUrl: baseURL,
-			clientId: CLI_OAUTH_CLIENT_ID
-		});
-	}
-};
-//#endregion
-//#region src/auth/providerKeyFailure.ts
-const PROVIDER_KEY_ERROR_CODES = /* @__PURE__ */ new Set(["provider_not_configured", "provider_rejected"]);
-/**
-* A 401 whose body names a missing or rejected AI-provider key (e.g. /api/ai/tts). The
-* Bike4Mind credential was accepted, so refreshing or re-authenticating cannot fix it.
-* Shared by the ApiClient refresh interceptor and mapApiError in mcp/b4mApiClient.ts.
-*/
-function isProviderKeyFailure(data) {
-	const body = decodeBinaryBody(data);
-	if (!body || typeof body !== "object") return false;
-	const { errorCode } = body;
-	return typeof errorCode === "string" && PROVIDER_KEY_ERROR_CODES.has(errorCode);
-}
-/**
-* An arraybuffer-typed request (every @bike4mind/sdk call, through ApiClient.fetch) gets its
-* error body as raw bytes, and the refresh interceptor sees it before any caller can decode it.
-*/
-function decodeBinaryBody(data) {
-	const bytes = data instanceof ArrayBuffer ? Buffer.from(data) : ArrayBuffer.isView(data) ? Buffer.from(data.buffer, data.byteOffset, data.byteLength) : void 0;
-	if (!bytes) return data;
-	try {
-		return JSON.parse(bytes.toString("utf8"));
-	} catch {
-		return;
-	}
-}
-//#endregion
-//#region src/auth/ApiClient.ts
-const USER_AGENT = `b4m-cli/${version}`;
-/**
-* Per-request timeout. Generous by design: a waited chat (POST /api/chat with wait:true)
-* runs a full server-side quest, so the bound only exists to stop a hung backend from
-* wedging a caller forever, not to cap a normal long quest. Override with B4M_API_TIMEOUT_MS
-* (0 disables the timeout entirely).
-*/
-const DEFAULT_API_TIMEOUT_MS = 6e5;
-function resolveTimeoutMs() {
-	const raw = process.env.B4M_API_TIMEOUT_MS;
-	if (raw === void 0 || raw.trim() === "") return DEFAULT_API_TIMEOUT_MS;
-	const parsed = Number(raw);
-	return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_API_TIMEOUT_MS;
-}
-/**
-* The shared authenticated client, wired to the CLI's storage, logger and branding.
-*/
-var ApiClient = class extends AuthenticatedApiClient {
-	/**
-	* @param apiKey - When set, requests authenticate with this instance API key via
-	*   the `x-api-key` header and the OAuth-JWT path (Bearer injection + refresh-on-401)
-	*   is bypassed entirely. Omit to keep the default stored-JWT behavior unchanged.
-	*/
-	constructor(baseURL = "http://localhost:3000", configStore, apiKey) {
-		super({
-			baseUrl: baseURL,
-			tokenStore: configStore || new ConfigStore(),
-			oauthClient: new OAuthClient(baseURL),
-			logger,
-			apiKey,
-			timeoutMs: resolveTimeoutMs(),
-			headers: {
-				"User-Agent": USER_AGENT,
-				"X-B4M-Client": USER_AGENT
-			},
-			reauthMessages: {
-				refreshFailed: "Authentication expired. Please run `b4m login` again.",
-				stillUnauthorized: "Authentication failed. Please run /login to authenticate.",
-				notLoggedIn: "Authentication failed: not logged in. Please run `b4m login` to authenticate."
-			},
-			isPassThrough401: isProviderKeyFailure
-		});
-		this.fetch = async (input, init = {}) => {
-			const headers = Object.fromEntries(new Headers(init.headers));
-			try {
-				return toFetchResponse(await this.getAxiosInstance().request({
-					url: input instanceof Request ? input.url : String(input),
-					method: init.method ?? "GET",
-					headers,
-					data: init.body ?? void 0,
-					signal: init.signal ?? void 0,
-					responseType: /text\/event-stream/i.test(headers.accept ?? "") ? "stream" : "arraybuffer",
-					...init.redirect && init.redirect !== "follow" ? { maxRedirects: 0 } : {}
-				}));
-			} catch (error) {
-				if (isAxiosError(error) && error.response) return toFetchResponse(error.response);
-				throw error;
-			}
-		};
-	}
-	get baseURL() {
-		return this.getAxiosInstance().defaults.baseURL ?? "";
-	}
-};
-function toFetchResponse(response) {
-	const headers = new Headers();
-	for (const [name, value] of Object.entries(response.headers)) if (value !== void 0 && value !== null) headers.set(name, Array.isArray(value) ? value.join(", ") : String(value));
-	const body = [
-		101,
-		204,
-		205,
-		304
-	].includes(response.status) ? null : response.data instanceof Readable ? Readable.toWeb(response.data) : response.data;
-	return new Response(body, {
-		status: response.status,
-		statusText: response.statusText,
-		headers
-	});
-}
-//#endregion
 //#region ../sdk/dist/index.mjs
 /**
 * A non-2xx response. `message` is the envelope's `error` (`ErrorResponse` in the spec); branch on `status` and
@@ -255,6 +124,10 @@ const operations = {
 		method: "POST",
 		path: "/api/v1/sessions"
 	},
+	createTextRefinement: {
+		method: "POST",
+		path: "/api/v1/text-refinements"
+	},
 	createTranscription: {
 		method: "POST",
 		path: "/api/v1/transcriptions"
@@ -331,6 +204,14 @@ const operations = {
 		method: "GET",
 		path: "/api/v1/artifacts/{id}/versions/{version}"
 	},
+	getClaudeMarketplace: {
+		method: "GET",
+		path: "/api/v1/skills/market/claude-marketplace.json"
+	},
+	getClaudePluginZip: {
+		method: "GET",
+		path: "/api/v1/skills/market/{id}/claude-plugin.zip"
+	},
 	getCreditBalance: {
 		method: "GET",
 		path: "/api/v1/credits"
@@ -371,6 +252,10 @@ const operations = {
 		method: "GET",
 		path: "/api/v1/video-generations/{id}"
 	},
+	getWhatsNewMedia: {
+		method: "GET",
+		path: "/api/v1/whats-new/media/{id}/{asset}"
+	},
 	listAgents: {
 		method: "GET",
 		path: "/api/v1/agents"
@@ -736,4 +621,4 @@ function toBase64(bytes) {
 	return btoa(binary);
 }
 //#endregion
-export { ApiClient as a, parseRetryAfterSeconds as i, B4mStreamEndedError as n, isProviderKeyFailure as o, createClient as r, OAuthClient as s, B4mApiError as t };
+export { parseRetryAfterSeconds as i, B4mStreamEndedError as n, createClient as r, B4mApiError as t };