@cleocode/caamp 2026.4.7 → 2026.4.9

package/dist/cli.js

@@ -52,7 +52,7 @@ import {
   tokenizeCriteriaValue,
   updateInstructionsSingleOperation,
   validateSkill
-} from "./chunk-HEAGCHKU.js";
+} from "./chunk-JC77OAHA.js";
 import {
   buildSkillsMap,
   checkAllInjections,
@@ -1873,7 +1873,7 @@ function registerMcpCommands(program2) {
   registerMcpRemoveCommand(mcp);
 }
 
-// src/commands/pi/extensions.ts
+// src/commands/pi/cant.ts
 import { existsSync as existsSync4 } from "fs";
 import { writeFile } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
@@ -1989,8 +1989,8 @@ function resolveProjectDir2(tier, explicit) {
   return process.cwd();
 }
 
-// src/commands/pi/extensions.ts
-async function resolveExtensionSource(source) {
+// src/commands/pi/cant.ts
+async function resolveCantSource(source) {
   if (source.startsWith("/") || source.startsWith("./") || source.startsWith("../") || source.startsWith("~")) {
     const expanded = source.startsWith("~/") ? join5(process.env["HOME"] ?? "", source.slice(2)) : source;
     if (!existsSync4(expanded)) {
@@ -2001,12 +2001,11 @@ async function resolveExtensionSource(source) {
         false
       );
     }
-    const inferredName = inferNameFromPath(expanded);
     return {
       localPath: expanded,
       cleanup: async () => {
       },
-      inferredName
+      inferredName: inferNameFromPath(expanded)
     };
   }
   if (/^https?:\/\//.test(source)) {
@@ -2058,7 +2057,7 @@ async function resolveExtensionSource(source) {
     }
     const body = await resp.text();
     const baseName = inferNameFromUrl(source);
-    const tmp = join5(tmpdir3(), `caamp-pi-ext-${process.pid}-${Date.now()}-${baseName}.ts`);
+    const tmp = join5(tmpdir3(), `caamp-pi-cant-${process.pid}-${Date.now()}-${baseName}.cant`);
     await writeFile(tmp, body, "utf8");
     return {
       localPath: tmp,
@@ -2093,15 +2092,265 @@ async function resolveExtensionSource(source) {
   throw new LAFSCommandError(
     PI_ERROR_CODES.VALIDATION,
     `Unsupported source: ${source}`,
-    "Use a local file path, HTTPS URL, or GitHub shorthand (owner/repo/path.ts).",
+    "Use a local file path, HTTPS URL, or GitHub shorthand (owner/repo/path.cant).",
     false
   );
 }
 function inferNameFromPath(filePath) {
   const base = filePath.split(/[/\\]/).pop() ?? filePath;
-  return base.replace(/\.(ts|tsx|mts)$/, "");
+  return base.replace(/\.cant$/, "");
 }
 function inferNameFromUrl(url) {
+  try {
+    const u = new URL(url);
+    const seg = u.pathname.split("/").filter(Boolean).pop() ?? "profile";
+    return seg.replace(/\.cant$/, "");
+  } catch {
+    return "profile";
+  }
+}
+async function invokeInstallCantProfile(harness, sourcePath, name, tier, projectDir, installOpts) {
+  try {
+    return await harness.installCantProfile(sourcePath, name, tier, projectDir, installOpts);
+  } catch (err) {
+    rethrowAsLafs(err);
+  }
+}
+function rethrowAsLafs(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  if (/already exists/i.test(message)) {
+    throw new LAFSCommandError(
+      PI_ERROR_CODES.CONFLICT,
+      message,
+      "Pass --force to overwrite the existing profile.",
+      false
+    );
+  }
+  if (/does not exist|not found/i.test(message)) {
+    throw new LAFSCommandError(PI_ERROR_CODES.NOT_FOUND, message, "Check the path.", false);
+  }
+  if (/failed cant-core validation|expected a CANT source file|not a regular file/i.test(message)) {
+    throw new LAFSCommandError(
+      PI_ERROR_CODES.VALIDATION,
+      message,
+      "Run `caamp pi cant validate <path>` to inspect the diagnostics.",
+      false
+    );
+  }
+  throw new LAFSCommandError(
+    "E_INTERNAL_UNEXPECTED",
+    message,
+    "Inspect the message for the underlying cant-core failure mode.",
+    false
+  );
+}
+function registerPiCantCommands(parent) {
+  const cant = parent.command("cant").description("Manage Pi CANT profiles across tiers");
+  cant.command("list").description("List Pi CANT profiles across project, user, and global tiers").option("--scope <tier>", "Filter to a single tier: project|user|global").option("--project-dir <path>", "Project directory for the project tier (default: cwd)").action(
+    async (opts) => runLafsCommand("pi.cant.list", "standard", async () => {
+      const harness = requirePiHarness();
+      const projectDir = opts.projectDir ?? process.cwd();
+      const allEntries = await harness.listCantProfiles(projectDir);
+      const filterTier = opts.scope === void 0 ? null : parseScope2(opts.scope, "project");
+      const entries = filterTier === null ? allEntries : allEntries.filter((e) => e.tier === filterTier);
+      const sorted = [...entries].sort((a, b) => a.name.localeCompare(b.name));
+      return {
+        count: sorted.length,
+        entries: sorted
+      };
+    })
+  );
+  cant.command("install <source>").description("Install a Pi CANT profile from a local path, HTTPS URL, or GitHub shorthand").option("--scope <tier>", "Install tier: project|user|global (default: project)").option("--name <name>", "Override the inferred profile name").option("--force", "Overwrite an existing profile at the target tier").option("--project-dir <path>", "Project directory for the project tier (default: cwd)").action(
+    async (source, opts) => runLafsCommand("pi.cant.install", "standard", async () => {
+      const harness = requirePiHarness();
+      const tier = parseScope2(opts.scope, "project");
+      const projectDir = resolveProjectDir2(tier, opts.projectDir);
+      const resolved = await resolveCantSource(source);
+      try {
+        const name = opts.name ?? resolved.inferredName;
+        const installOpts = { force: opts.force ?? false };
+        const result = await invokeInstallCantProfile(
+          harness,
+          resolved.localPath,
+          name,
+          tier,
+          projectDir,
+          installOpts
+        );
+        return {
+          installed: {
+            name,
+            tier: result.tier,
+            targetPath: result.targetPath,
+            counts: result.counts,
+            source
+          }
+        };
+      } finally {
+        await resolved.cleanup();
+      }
+    })
+  );
+  cant.command("remove <name>").description("Remove a Pi CANT profile from the given tier").option("--scope <tier>", "Target tier: project|user|global (default: project)").option("--project-dir <path>", "Project directory for the project tier (default: cwd)").action(
+    async (name, opts) => runLafsCommand("pi.cant.remove", "standard", async () => {
+      const harness = requirePiHarness();
+      const tier = parseScope2(opts.scope, "project");
+      const projectDir = resolveProjectDir2(tier, opts.projectDir);
+      const removed = await harness.removeCantProfile(name, tier, projectDir);
+      return {
+        name,
+        tier,
+        removed
+      };
+    })
+  );
+  cant.command("validate <path>").description("Validate a .cant file via cant-core without installing it").action(
+    async (path) => runLafsCommand("pi.cant.validate", "standard", async () => {
+      const harness = requirePiHarness();
+      if (!existsSync4(path)) {
+        throw new LAFSCommandError(
+          PI_ERROR_CODES.NOT_FOUND,
+          `Source file does not exist: ${path}`,
+          "Check the path and try again.",
+          false
+        );
+      }
+      const result = await harness.validateCantProfile(path);
+      if (!result.valid) {
+        throw new LAFSCommandError(
+          PI_ERROR_CODES.VALIDATION,
+          `cant-core validation failed with ${result.errors.length} diagnostic(s)`,
+          "See the `errors` field for ruleId/line/col/message details.",
+          false,
+          { valid: false, counts: result.counts, errors: result.errors }
+        );
+      }
+      return {
+        valid: true,
+        counts: result.counts,
+        errors: result.errors
+      };
+    })
+  );
+}
+
+// src/commands/pi/extensions.ts
+import { existsSync as existsSync5 } from "fs";
+import { writeFile as writeFile2 } from "fs/promises";
+import { tmpdir as tmpdir4 } from "os";
+import { join as join6 } from "path";
+async function resolveExtensionSource(source) {
+  if (source.startsWith("/") || source.startsWith("./") || source.startsWith("../") || source.startsWith("~")) {
+    const expanded = source.startsWith("~/") ? join6(process.env["HOME"] ?? "", source.slice(2)) : source;
+    if (!existsSync5(expanded)) {
+      throw new LAFSCommandError(
+        PI_ERROR_CODES.NOT_FOUND,
+        `Source file does not exist: ${expanded}`,
+        "Check the path and try again.",
+        false
+      );
+    }
+    const inferredName = inferNameFromPath2(expanded);
+    return {
+      localPath: expanded,
+      cleanup: async () => {
+      },
+      inferredName
+    };
+  }
+  if (/^https?:\/\//.test(source)) {
+    const parsed2 = parseSource(source);
+    if (parsed2.type === "github" && parsed2.owner !== void 0 && parsed2.repo !== void 0) {
+      const cloneResult = await cloneRepo(parsed2.owner, parsed2.repo, parsed2.ref);
+      const filePath = parsed2.path !== void 0 ? join6(cloneResult.localPath, parsed2.path) : cloneResult.localPath;
+      if (!existsSync5(filePath)) {
+        await cloneResult.cleanup();
+        throw new LAFSCommandError(
+          PI_ERROR_CODES.NOT_FOUND,
+          `Source path not found inside cloned repo: ${parsed2.path ?? "(root)"}`,
+          "Check the repository URL and path.",
+          false
+        );
+      }
+      return {
+        localPath: filePath,
+        cleanup: cloneResult.cleanup,
+        inferredName: inferNameFromPath2(filePath)
+      };
+    }
+    if (parsed2.type === "gitlab" && parsed2.owner !== void 0 && parsed2.repo !== void 0) {
+      const cloneResult = await cloneGitLabRepo(parsed2.owner, parsed2.repo, parsed2.ref);
+      const filePath = parsed2.path !== void 0 ? join6(cloneResult.localPath, parsed2.path) : cloneResult.localPath;
+      if (!existsSync5(filePath)) {
+        await cloneResult.cleanup();
+        throw new LAFSCommandError(
+          PI_ERROR_CODES.NOT_FOUND,
+          `Source path not found inside cloned repo: ${parsed2.path ?? "(root)"}`,
+          "Check the repository URL and path.",
+          false
+        );
+      }
+      return {
+        localPath: filePath,
+        cleanup: cloneResult.cleanup,
+        inferredName: inferNameFromPath2(filePath)
+      };
+    }
+    const resp = await fetchWithTimeout(source);
+    if (!resp.ok) {
+      throw new LAFSCommandError(
+        PI_ERROR_CODES.TRANSIENT,
+        `Failed to download source from ${source}: HTTP ${resp.status}`,
+        "Check the URL and network connectivity.",
+        true
+      );
+    }
+    const body = await resp.text();
+    const baseName = inferNameFromUrl2(source);
+    const tmp = join6(tmpdir4(), `caamp-pi-ext-${process.pid}-${Date.now()}-${baseName}.ts`);
+    await writeFile2(tmp, body, "utf8");
+    return {
+      localPath: tmp,
+      cleanup: async () => {
+        try {
+          await (await import("fs/promises")).rm(tmp, { force: true });
+        } catch {
+        }
+      },
+      inferredName: baseName
+    };
+  }
+  const parsed = parseSource(source);
+  if (parsed.type === "github" && parsed.owner !== void 0 && parsed.repo !== void 0) {
+    const cloneResult = await cloneRepo(parsed.owner, parsed.repo, parsed.ref);
+    const filePath = parsed.path !== void 0 ? join6(cloneResult.localPath, parsed.path) : cloneResult.localPath;
+    if (!existsSync5(filePath)) {
+      await cloneResult.cleanup();
+      throw new LAFSCommandError(
+        PI_ERROR_CODES.NOT_FOUND,
+        `Source path not found inside cloned repo: ${parsed.path ?? "(root)"}`,
+        "Check the repository shorthand and path.",
+        false
+      );
+    }
+    return {
+      localPath: filePath,
+      cleanup: cloneResult.cleanup,
+      inferredName: inferNameFromPath2(filePath)
+    };
+  }
+  throw new LAFSCommandError(
+    PI_ERROR_CODES.VALIDATION,
+    `Unsupported source: ${source}`,
+    "Use a local file path, HTTPS URL, or GitHub shorthand (owner/repo/path.ts).",
+    false
+  );
+}
+function inferNameFromPath2(filePath) {
+  const base = filePath.split(/[/\\]/).pop() ?? filePath;
+  return base.replace(/\.(ts|tsx|mts)$/, "");
+}
+function inferNameFromUrl2(url) {
   try {
     const u = new URL(url);
     const seg = u.pathname.split("/").filter(Boolean).pop() ?? "extension";
@@ -2342,8 +2591,8 @@ function registerPiModelsCommands(parent) {
 }
 
 // src/commands/pi/prompts.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join6, resolve } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { join as join7, resolve } from "path";
 function inferPromptName(sourceDir) {
   const normalized = resolve(sourceDir).replace(/[\\/]+$/, "");
   const base = normalized.split(/[\\/]/).pop();
@@ -2365,7 +2614,7 @@ function registerPiPromptsCommands(parent) {
       const tier = parseScope2(opts.scope, "project");
       const projectDir = resolveProjectDir2(tier, opts.projectDir);
       const absSource = resolve(source);
-      if (!existsSync5(absSource)) {
+      if (!existsSync6(absSource)) {
         throw new LAFSCommandError(
           PI_ERROR_CODES.NOT_FOUND,
           `Source directory does not exist: ${absSource}`,
@@ -2373,7 +2622,7 @@ function registerPiPromptsCommands(parent) {
           false
         );
       }
-      if (!existsSync5(join6(absSource, "prompt.md"))) {
+      if (!existsSync6(join7(absSource, "prompt.md"))) {
         throw new LAFSCommandError(
           PI_ERROR_CODES.VALIDATION,
           `Source directory is missing prompt.md: ${absSource}`,
@@ -2418,7 +2667,7 @@ function registerPiPromptsCommands(parent) {
 
 // src/commands/pi/sessions.ts
 import { spawn } from "child_process";
-import { createReadStream, createWriteStream, existsSync as existsSync6 } from "fs";
+import { createReadStream, createWriteStream, existsSync as existsSync7 } from "fs";
 import { createInterface } from "readline/promises";
 async function streamSession(filePath, outputPath, transform) {
   const writeToFile = outputPath !== void 0 && outputPath.length > 0;
@@ -2575,7 +2824,7 @@ function registerPiSessionsCommands(parent) {
         );
       }
       const piBinary = harness.provider.detection.binary ?? "pi";
-      if (!existsSync6(piBinary) && piBinary === "pi") {
+      if (!existsSync7(piBinary) && piBinary === "pi") {
       }
       const child = spawn(piBinary, ["--session", id], {
         stdio: "inherit",
@@ -2602,7 +2851,7 @@ function registerPiSessionsCommands(parent) {
 }
 
 // src/commands/pi/themes.ts
-import { existsSync as existsSync7, statSync } from "fs";
+import { existsSync as existsSync8, statSync } from "fs";
 import { extname, resolve as resolve2 } from "path";
 function inferThemeName(sourceFile) {
   const base = resolve2(sourceFile).split(/[\\/]/).pop();
@@ -2626,7 +2875,7 @@ function registerPiThemesCommands(parent) {
       const tier = parseScope2(opts.scope, "project");
       const projectDir = resolveProjectDir2(tier, opts.projectDir);
       const absSource = resolve2(source);
-      if (!existsSync7(absSource)) {
+      if (!existsSync8(absSource)) {
         throw new LAFSCommandError(
           PI_ERROR_CODES.NOT_FOUND,
           `Source theme does not exist: ${absSource}`,
@@ -2680,12 +2929,13 @@ function registerPiThemesCommands(parent) {
 
 // src/commands/pi/index.ts
 function registerPiCommands(program2) {
-  const pi = program2.command("pi").description("Pi harness operations (extensions, sessions, models, prompts, themes)");
+  const pi = program2.command("pi").description("Pi harness operations (extensions, sessions, models, prompts, themes, cant)");
   registerPiExtensionsCommands(pi);
   registerPiSessionsCommands(pi);
   registerPiModelsCommands(pi);
   registerPiPromptsCommands(pi);
   registerPiThemesCommands(pi);
+  registerPiCantCommands(pi);
 }
 
 // src/commands/providers.ts
@@ -3277,13 +3527,13 @@ function emitJsonError2(operation, mvi, code, message, category, details = {}) {
 }
 
 // src/commands/skills/audit.ts
-import { existsSync as existsSync8, statSync as statSync2 } from "fs";
+import { existsSync as existsSync9, statSync as statSync2 } from "fs";
 import pc7 from "picocolors";
 function registerSkillsAudit(parent) {
   parent.command("audit").description("Security scan skill files (46+ rules, SARIF output)").argument("[path]", "Path to SKILL.md or directory", ".").option("--sarif", "Output in SARIF format (raw SARIF, not LAFS envelope)").option("--json", "Output as JSON (LAFS envelope)").option("--human", "Output in human-readable format").action(async (path, opts) => {
     const operation = "skills.audit";
     const mvi = "standard";
-    if (!existsSync8(path)) {
+    if (!existsSync9(path)) {
       const message = `Path not found: ${path}`;
       if (opts.sarif) {
         console.error(
@@ -3855,9 +4105,9 @@ function emitJsonError3(operation, mvi, code, message, category, details = {}) {
 }
 
 // src/commands/skills/init.ts
-import { existsSync as existsSync9 } from "fs";
-import { mkdir, writeFile as writeFile2 } from "fs/promises";
-import { join as join7 } from "path";
+import { existsSync as existsSync10 } from "fs";
+import { mkdir, writeFile as writeFile3 } from "fs/promises";
+import { join as join8 } from "path";
 import pc10 from "picocolors";
 function registerSkillsInit(parent) {
   parent.command("init").description("Create a new SKILL.md template").argument("[name]", "Skill name").option("-d, --dir <path>", "Output directory", ".").option("--json", "Output as JSON (default)").option("--human", "Output in human-readable format").action(
@@ -3883,8 +4133,8 @@ function registerSkillsInit(parent) {
         process.exit(1);
       }
       const skillName = name ?? "my-skill";
-      const skillDir = join7(opts.dir, skillName);
-      if (existsSync9(skillDir)) {
+      const skillDir = join8(opts.dir, skillName);
+      if (existsSync10(skillDir)) {
         const message = `Directory already exists: ${skillDir}`;
         if (format === "json") {
           emitJsonError(
@@ -3926,7 +4176,7 @@ Provide detailed instructions for the AI agent here.
 
 Show example inputs and expected outputs.
 `;
-      await writeFile2(join7(skillDir, "SKILL.md"), template, "utf-8");
+      await writeFile3(join8(skillDir, "SKILL.md"), template, "utf-8");
       const result = {
         name: skillName,
         directory: skillDir,
@@ -3940,14 +4190,14 @@ Show example inputs and expected outputs.
       console.log(pc10.green(`\u2713 Created skill template: ${skillDir}/SKILL.md`));
       console.log(pc10.dim("\nNext steps:"));
       console.log(pc10.dim("  1. Edit SKILL.md with your instructions"));
-      console.log(pc10.dim(`  2. Validate: caamp skills validate ${join7(skillDir, "SKILL.md")}`));
+      console.log(pc10.dim(`  2. Validate: caamp skills validate ${join8(skillDir, "SKILL.md")}`));
       console.log(pc10.dim(`  3. Install: caamp skills install ${skillDir}`));
     }
   );
 }
 
 // src/commands/skills/install.ts
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 import pc11 from "picocolors";
 function registerSkillsInstall(parent) {
   parent.command("install").description("Install a skill from GitHub, URL, marketplace, or registered skill library").argument("[source]", "Skill source (GitHub URL, owner/repo, @author/name, skill-name)").option(
@@ -4432,7 +4682,7 @@ async function handleMarketplaceSource(source, _providers, _isGlobal, format, op
     for (const subPath of subPathCandidates) {
       try {
         const result = await cloneRepo(parsed.owner, parsed.repo, parsed.ref, subPath);
-        if (subPath && !existsSync10(result.localPath)) {
+        if (subPath && !existsSync11(result.localPath)) {
           await result.cleanup();
           continue;
         }