@codemieai/code 0.0.58 → 0.1.0

package/dist/cli/commands/skills/lib/run-skills-cli.js

@@ -0,0 +1,217 @@
+/**
+ * Spawns the upstream `skills` CLI as a child Node process with safe defaults:
+ *
+ * - Blocks upstream telemetry/audit egress to `add-skill.vercel.sh` via a
+ *   `NODE_OPTIONS=--require <shim>` injection.
+ * - Sets `DO_NOT_TRACK` / `DISABLE_TELEMETRY` / `CI` so the upstream
+ *   `track()` env gate is closed.
+ * - Inherits stdio so interactive prompts from `skills.sh` keep working.
+ *
+ * Resolution rules:
+ *
+ * - The skills bin is resolved from the project's `node_modules`
+ *   (`skills/bin/cli.mjs`).
+ * - The egress shim is resolved from this module's own directory; both the
+ *   source layout (`<repo>/src/cli/commands/skills/lib`) and the dist layout
+ *   (`<repo>/dist/cli/commands/skills/lib`) are supported by walking up to
+ *   the package root and checking `dist/assets/...` first, then
+ *   `assets/...` as a fallback for ts-node / dev runs.
+ */
+import { spawn } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { logger } from '../../../../utils/logger.js';
+import { getDirname } from '../../../../utils/paths.js';
+import { SKILLS_SH_TELEMETRY_MARKER } from './skills-sh-telemetry.js';
+const SHIM_FILENAME = 'skills-sh-egress-guard.cjs';
+/**
+ * Spawn the upstream `skills` CLI directly (not via the project `exec()` helper)
+ * because that helper rejects on non-zero exit when `interactive: true`. We need
+ * to surface the real exit code so `classifySkillError()` can map upstream
+ * failures to stable `error_code` values; rejection collapses everything to
+ * `unknown`.
+ *
+ * Even in interactive mode, child stderr is captured (in addition to being
+ * tee'd to the parent terminal) so that markers like
+ * `CODEMIE_SKILL_EGRESS_BLOCKED` remain visible to the classifier.
+ */
+export async function runSkillsCli(args, options = {}) {
+    const skillsBin = resolveSkillsBin();
+    const shimPath = resolveShimPath();
+    const interactive = options.interactive !== false;
+    const baseEnv = {
+        NODE_OPTIONS: buildNodeOptions(shimPath),
+    };
+    if (args[0] === 'add' || args[0] === 'remove' || args[0] === 'update') {
+        // We temporarily reopen upstream's telemetry gate only after resolving
+        // NODE_OPTIONS with the CodeMie egress guard shim. The shim captures the
+        // selected-skill payload locally and blocks add-skill.vercel.sh, so the
+        // request never leaves the machine.
+        baseEnv.DO_NOT_TRACK = '';
+        baseEnv.DISABLE_TELEMETRY = '';
+        baseEnv.CODEMIE_CAPTURE_SKILLS_SH_INSTALL_TELEMETRY = '1';
+        if (args[0] === 'update') {
+            baseEnv.CODEMIE_CAPTURE_SKILLS_SH_UPDATE_STDOUT = '1';
+        }
+    }
+    else {
+        baseEnv.DO_NOT_TRACK = '1';
+        baseEnv.DISABLE_TELEMETRY = '1';
+    }
+    // Force CI=1 only for non-interactive runs to suppress any prompts the
+    // upstream might fire. Forcing it on interactive runs interferes with
+    // Clack/inquirer prompt + spinner behavior; DO_NOT_TRACK / DISABLE_TELEMETRY
+    // already cover the telemetry gate.
+    if (!interactive) {
+        baseEnv.CI = process.env.CI ?? '1';
+    }
+    const env = { ...process.env, ...baseEnv, ...options.env };
+    const timeoutMs = options.timeoutMs;
+    logger.debug('[skills] Spawning skills CLI', {
+        bin: skillsBin,
+        args,
+        interactive,
+        shimPath,
+    });
+    return new Promise((resolve, reject) => {
+        // Interactive runs inherit stdout so the child sees a real TTY: Clack's
+        // multiselect renderer (used by skills.sh) computes visible rows from
+        // process.stdout.rows, which is undefined when stdout is a pipe — turning
+        // every prompt into an empty list. stderr stays piped so error markers
+        // (e.g. CODEMIE_SKILL_EGRESS_BLOCKED) still reach classifySkillError().
+        // Non-interactive callers (e.g. `list --json`) need captured stdout, so
+        // both streams pipe in that mode.
+        const stdio = interactive
+            ? ['inherit', 'inherit', 'pipe']
+            : ['inherit', 'pipe', 'pipe'];
+        const child = spawn(process.execPath, [skillsBin, ...args], {
+            cwd: options.cwd ?? process.cwd(),
+            env,
+            stdio,
+            windowsHide: os.platform() === 'win32',
+        });
+        let stdout = '';
+        let stderr = '';
+        let interactiveStderrBuffer = '';
+        let timedOut = false;
+        let timeout;
+        let forceKillTimeout;
+        let settled = false;
+        const cleanup = () => {
+            if (timeout) {
+                clearTimeout(timeout);
+                timeout = undefined;
+            }
+            if (forceKillTimeout) {
+                clearTimeout(forceKillTimeout);
+                forceKillTimeout = undefined;
+            }
+        };
+        const timeoutMessage = () => {
+            const seconds = Math.ceil((timeoutMs ?? 0) / 1000);
+            return `CODEMIE_SKILLS_TIMEOUT: skills CLI did not finish within ${seconds}s.`;
+        };
+        // stdout is null when inherited (interactive mode); only fires when piped.
+        child.stdout?.on('data', (data) => {
+            stdout += data.toString();
+        });
+        child.stderr?.on('data', (data) => {
+            const text = data.toString();
+            stderr += text;
+            if (interactive) {
+                interactiveStderrBuffer += text;
+                const lines = interactiveStderrBuffer.split(/\r?\n/);
+                interactiveStderrBuffer = lines.pop() ?? '';
+                for (const line of lines) {
+                    if (!line.startsWith(`${SKILLS_SH_TELEMETRY_MARKER} `)) {
+                        process.stderr.write(`${line}\n`);
+                    }
+                }
+            }
+        });
+        child.on('error', (error) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+            reject(new Error(`Failed to spawn skills CLI: ${error.message}`));
+        });
+        child.on('close', (code, signal) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+            if (interactive &&
+                interactiveStderrBuffer.length > 0 &&
+                !interactiveStderrBuffer.startsWith(`${SKILLS_SH_TELEMETRY_MARKER} `)) {
+                process.stderr.write(interactiveStderrBuffer);
+            }
+            resolve({
+                code: timedOut ? 124 : code ?? (signal ? 130 : 1),
+                stdout: stdout.trim(),
+                stderr: stderr.trim(),
+                signal,
+            });
+        });
+        if (timeoutMs && timeoutMs > 0) {
+            timeout = setTimeout(() => {
+                timedOut = true;
+                const message = timeoutMessage();
+                stderr += stderr.length > 0 ? `\n${message}` : message;
+                child.kill('SIGTERM');
+                forceKillTimeout = setTimeout(() => {
+                    if (!settled) {
+                        child.kill('SIGKILL');
+                    }
+                }, 5000);
+            }, timeoutMs);
+        }
+    });
+}
+function resolveSkillsBin() {
+    // Test-only override: e2e tests point this at a stub bin so they exercise
+    // the wrapper end-to-end without touching the network. Production code must
+    // never set this — it is intentionally undocumented to users.
+    const override = process.env.CODEMIE_SKILLS_BIN_OVERRIDE;
+    if (override && existsSync(override)) {
+        return override;
+    }
+    const requireFromHere = createRequire(import.meta.url);
+    try {
+        return requireFromHere.resolve('skills/bin/cli.mjs');
+    }
+    catch (error) {
+        throw new Error(`Failed to resolve "skills" CLI binary. Run "npm install" in the codemie-code package. Underlying error: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function resolveShimPath() {
+    const here = getDirname(import.meta.url);
+    // Walk up from <root>/src/cli/commands/skills/lib (or its dist twin) to <root>.
+    // Five "../" hops cover both layouts.
+    const projectRoot = path.resolve(here, '..', '..', '..', '..', '..');
+    const candidates = [
+        path.join(projectRoot, 'dist', 'assets', SHIM_FILENAME),
+        path.join(projectRoot, 'assets', SHIM_FILENAME),
+    ];
+    for (const candidate of candidates) {
+        if (existsSync(candidate)) {
+            return candidate;
+        }
+    }
+    throw new Error(`Failed to locate skills.sh egress guard shim "${SHIM_FILENAME}". Looked in: ${candidates.join(', ')}`);
+}
+function buildNodeOptions(shimAbsPath) {
+    // Forward slashes work on all platforms (Node accepts them on Windows too)
+    // and avoid backslash-handling edge cases in NODE_OPTIONS on Windows.
+    const normalizedPath = shimAbsPath.replaceAll('\\', '/');
+    const ours = `--require "${normalizedPath}"`;
+    const inherited = process.env.NODE_OPTIONS;
+    // Preserve user-supplied NODE_OPTIONS (e.g., --max-old-space-size) but
+    // append our require so the shim runs first in child processes.
+    return inherited ? `${inherited} ${ours}` : ours;
+}
+//# sourceMappingURL=run-skills-cli.js.map

package/dist/cli/commands/skills/lib/run-skills-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-skills-cli.js","sourceRoot":"","sources":["../../../../../src/cli/commands/skills/lib/run-skills-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAEtE,MAAM,aAAa,GAAG,4BAA4B,CAAC;AAgBnD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAc,EACd,UAA+B,EAAE;IAEjC,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC;IAElD,MAAM,OAAO,GAA2B;QACtC,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC;KACzC,CAAC;IACF,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,oCAAoC;QACpC,OAAO,CAAC,YAAY,GAAG,EAAE,CAAC;QAC1B,OAAO,CAAC,iBAAiB,GAAG,EAAE,CAAC;QAC/B,OAAO,CAAC,2CAA2C,GAAG,GAAG,CAAC;QAC1D,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YACzB,OAAO,CAAC,uCAAuC,GAAG,GAAG,CAAC;QACxD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,YAAY,GAAG,GAAG,CAAC;QAC3B,OAAO,CAAC,iBAAiB,GAAG,GAAG,CAAC;IAClC,CAAC;IACD,uEAAuE;IACvE,sEAAsE;IACtE,6EAA6E;IAC7E,oCAAoC;IACpC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC;IACrC,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAEpC,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;QAC3C,GAAG,EAAE,SAAS;QACd,IAAI;QACJ,WAAW;QACX,QAAQ;KACT,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACjD,wEAAwE;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,KAAK,GAA4C,WAAW;YAChE,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC;YAChC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,EAAE;YAC1D,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YACjC,GAAG;YACH,KAAK;YACL,WAAW,EAAE,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO;SACvC,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,uBAAuB,GAAG,EAAE,CAAC;QACjC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,OAAmC,CAAC;QACxC,IAAI,gBAA4C,CAAC;QACjD,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,IAAI,OAAO,EAAE,CAAC;gBACZ,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,GAAG,SAAS,CAAC;YACtB,CAAC;YACD,IAAI,gBAAgB,EAAE,CAAC;gBACrB,YAAY,CAAC,gBAAgB,CAAC,CAAC;gBAC/B,gBAAgB,GAAG,SAAS,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,cAAc,GAAG,GAAW,EAAE;YAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACnD,OAAO,4DAA4D,OAAO,IAAI,CAAC;QACjF,CAAC,CAAC;QAEF,2EAA2E;QAC3E,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACxC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,IAAI,CAAC;YACf,IAAI,WAAW,EAAE,CAAC;gBAChB,uBAAuB,IAAI,IAAI,CAAC;gBAChC,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACrD,uBAAuB,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;gBAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,0BAA0B,GAAG,CAAC,EAAE,CAAC;wBACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;oBACpC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,IACE,WAAW;gBACX,uBAAuB,CAAC,MAAM,GAAG,CAAC;gBAClC,CAAC,uBAAuB,CAAC,UAAU,CAAC,GAAG,0BAA0B,GAAG,CAAC,EACrE,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAChD,CAAC;YACD,OAAO,CAAC;gBACN,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjD,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;gBACrB,MAAM;aACP,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAI,SAAS,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBACxB,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;gBACjC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;gBACvD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtB,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE;oBACjC,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACxB,CAAC;gBACH,CAAC,EAAE,IAAI,CAAC,CAAC;YACX,CAAC,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB;IACvB,0EAA0E;IAC1E,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACzD,IAAI,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,eAAe,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,2GACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,gFAAgF;IAChF,sCAAsC;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAErE,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC;KAChD,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,iDAAiD,aAAa,iBAAiB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvG,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAmB;IAC3C,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,cAAc,GAAG,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,cAAc,cAAc,GAAG,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC3C,uEAAuE;IACvE,gEAAgE;IAChE,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACnD,CAAC"}

package/dist/cli/commands/skills/lib/sanitize.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Sanitizers for optional wrapper-known metric values.
+ *
+ * Strict goals:
+ * - strip user:pass credentials from URLs
+ * - normalize the user's home directory to `~/...`
+ * - strip control characters
+ * - cap string length and list size
+ *
+ * Non-goals:
+ * - classifying source as GitHub/GitLab/internal/public
+ * - resolving aliases or catalog metadata
+ */
+export declare function sanitizeSource(source: string | undefined): string | undefined;
+export declare function capList(values: readonly string[] | undefined, max?: number): string[] | undefined;
+export declare function stripControlChars(value: string): string;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/cli/commands/skills/lib/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/skills/lib/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAgB7E;AAED,wBAAgB,OAAO,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,GAAG,GAAE,MAAuB,GAAG,MAAM,EAAE,GAAG,SAAS,CAejH;AAqBD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvD"}

package/dist/cli/commands/skills/lib/sanitize.js

@@ -0,0 +1,73 @@
+/**
+ * Sanitizers for optional wrapper-known metric values.
+ *
+ * Strict goals:
+ * - strip user:pass credentials from URLs
+ * - normalize the user's home directory to `~/...`
+ * - strip control characters
+ * - cap string length and list size
+ *
+ * Non-goals:
+ * - classifying source as GitHub/GitLab/internal/public
+ * - resolving aliases or catalog metadata
+ */
+import os from 'node:os';
+const MAX_SOURCE_LENGTH = 256;
+const MAX_LIST_ITEMS = 20;
+const MAX_LIST_ITEM_LENGTH = 128;
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARS = /[\u0000-\u001F\u007F]/g;
+export function sanitizeSource(source) {
+    if (!source) {
+        return undefined;
+    }
+    const trimmed = source.trim();
+    if (trimmed.length === 0) {
+        return undefined;
+    }
+    let cleaned = stripCredentials(trimmed);
+    cleaned = normalizeHome(cleaned);
+    cleaned = stripControlChars(cleaned);
+    cleaned = capLength(cleaned, MAX_SOURCE_LENGTH);
+    return cleaned.length > 0 ? cleaned : undefined;
+}
+export function capList(values, max = MAX_LIST_ITEMS) {
+    if (!values || values.length === 0) {
+        return undefined;
+    }
+    const cleaned = values
+        .map((value) => stripControlChars(value).trim())
+        .filter((value) => value.length > 0)
+        .map((value) => capLength(value, MAX_LIST_ITEM_LENGTH));
+    if (cleaned.length === 0) {
+        return undefined;
+    }
+    return cleaned.slice(0, max);
+}
+function stripCredentials(value) {
+    // Match scheme://user:pass@host or scheme://user@host and remove the user info
+    return value.replace(/^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)([^/@\s]+@)/, '$1');
+}
+function normalizeHome(value) {
+    const home = os.homedir();
+    if (!home) {
+        return value;
+    }
+    if (value === home) {
+        return '~';
+    }
+    if (value.startsWith(`${home}/`) || value.startsWith(`${home}\\`)) {
+        return `~${value.slice(home.length)}`;
+    }
+    return value;
+}
+export function stripControlChars(value) {
+    return value.replace(CONTROL_CHARS, '');
+}
+function capLength(value, max) {
+    if (value.length <= max) {
+        return value;
+    }
+    return `${value.slice(0, max - 1)}…`;
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/cli/commands/skills/lib/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../../../src/cli/commands/skills/lib/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,4CAA4C;AAC5C,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAE/C,MAAM,UAAU,cAAc,CAAC,MAA0B;IACvD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACxC,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAEhD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,MAAqC,EAAE,MAAc,cAAc;IACzF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM;SACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;SAC/C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAE1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,+EAA+E;IAC/E,OAAO,KAAK,CAAC,OAAO,CAAC,4CAA4C,EAAE,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,GAAW;IAC3C,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;AACvC,CAAC"}

package/dist/cli/commands/skills/lib/skills-metrics.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Lifecycle event emitter for `codemie skills *` commands.
+ *
+ * Each event is POSTed to the CodeMie backend at `/v1/skills/events`, where
+ * it is persisted in Postgres (authoritative, durable) and mirrored to the
+ * legacy Elastic-backed metrics path. Postgres survives Elastic retention,
+ * so install-count / popularity queries remain accurate forever.
+ *
+ * Behaviour:
+ * - **Auth-gated (spec §7).** If no SSO credentials are present, the helper
+ *   becomes a no-op silently — no event is sent.
+ * - **Fan-out per skill.** When the wrapper knows which skills the operation
+ *   targets (explicit `--skill foo bar`), one POST is emitted per skill so
+ *   the backend stores `(event, skill)` rows and trivial COUNT(*) queries
+ *   work. For ops without a specific skill (bare `list`, interactive `add`),
+ *   a single POST is sent with `skill_*` fields null.
+ * - **Best-effort.** Any failure to load credentials, resolve the API URL,
+ *   or POST is logged at debug level and swallowed — telemetry must never
+ *   block a real user command.
+ */
+export type SkillCommand = 'add' | 'update' | 'remove' | 'list' | 'find';
+export type SkillStatus = 'started' | 'completed' | 'failed';
+export type SkillScope = 'global' | 'project' | 'unknown';
+export type AgentSelectionMode = 'explicit' | 'auto_detected' | 'prompted' | 'upstream';
+interface PartialAttributes {
+    scope?: SkillScope;
+    source?: string;
+    skill_names?: string[];
+    skill_count?: number;
+    target_agents?: string[];
+    agent_selection_mode?: AgentSelectionMode;
+    error_code?: string;
+    /**
+     * Forward-compat escape hatch matching the backend `attributes` JSONB
+     * field on `SkillEventRequest`. Use this for command-specific telemetry
+     * that does not fit the strict top-level schema.
+     */
+    attributes?: Record<string, unknown>;
+}
+export interface SkillMetricSession {
+    command: SkillCommand;
+    sessionId: string;
+    agentVersion: string;
+    workingDirectory: string;
+    /**
+     * Resolved transport. `null` when no SSO credentials are available — every
+     * `emit*` becomes a no-op.
+     */
+    transport: SkillEventTransport | null;
+}
+interface SkillEventTransport {
+    apiUrl: string;
+    cookieHeader: string;
+    cliVersion: string;
+}
+/**
+ * Build a metric session for a single `codemie skills <command>` invocation.
+ * Loads SSO credentials best-effort; if anything fails, returns a session
+ * whose `transport` is null and the lifecycle helpers become no-ops.
+ */
+export declare function startSkillMetric(command: SkillCommand, workingDirectory?: string): Promise<SkillMetricSession>;
+export declare function emitStarted(session: SkillMetricSession, partial: Pick<PartialAttributes, 'scope' | 'source' | 'skill_names' | 'skill_count' | 'target_agents' | 'agent_selection_mode'>): Promise<void>;
+export declare function emitCompleted(session: SkillMetricSession, partial: PartialAttributes): Promise<void>;
+export declare function emitFailed(session: SkillMetricSession, partial: PartialAttributes): Promise<void>;
+/**
+ * Mirror of upstream `skills` CLI `toSkillSlug`. Keeping the algorithm
+ * byte-for-byte identical means the canonical `<source>/<slug>` we send
+ * matches whatever the upstream tooling computes, so cross-system joins
+ * (e.g. comparing our install counts to skills.sh download counts) work
+ * without a translation layer.
+ */
+export declare function toSkillSlug(name: string): string;
+export {};
+//# sourceMappingURL=skills-metrics.d.ts.map

package/dist/cli/commands/skills/lib/skills-metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-metrics.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/skills/lib/skills-metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAgBH,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAC7D,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAC1D,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,eAAe,GAAG,UAAU,GAAG,UAAU,CAAC;AAExF,UAAU,iBAAiB;IACzB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,oBAAoB,CAAC,EAAE,kBAAkB,CAAC;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,SAAS,EAAE,mBAAmB,GAAG,IAAI,CAAC;CACvC;AAED,UAAU,mBAAmB;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,YAAY,EACrB,gBAAgB,SAAgB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CAY7B;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,IAAI,CACX,iBAAiB,EACjB,OAAO,GAAG,QAAQ,GAAG,aAAa,GAAG,aAAa,GAAG,eAAe,GAAG,sBAAsB,CAC9F,GACA,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,UAAU,CAC9B,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,IAAI,CAAC,CAEf;AAoKD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQhD"}