@fprad0/skill-master-mcp 0.0.5 → 0.0.7

package/CHANGELOG.md

@@ -7,6 +7,18 @@ All notable changes to `skill_master` will be tracked here.
 - Prepare a public npm publication path with dedicated workflow and operator guide.
 - Upgrade release automation from Node `20` to Node `22`.
 
+## [0.0.7] - 2026-06-26
+
+- Add a visual terminal menu for `skill-master-menu` using `prompts`, with TTY detection and direct action mode.
+- Extract the menu core into a reusable module for tests and future UI changes.
+- Keep the package compatible with Node `18+` instead of moving to a heavier TUI stack.
+
+## [0.0.6] - 2026-06-26
+
+- Harden `skill-master-configure-private-registry` with HTTPS registry validation, scoped token handling, redacted dry-runs, timestamped backups, and POSIX `0600` permissions.
+- Store `${GITHUB_PACKAGES_TOKEN}` in `.npmrc` by default instead of persisting a literal token.
+- Add `--token-file`, `--token-stdin`, and explicit `--store-token` support for safer operator workflows.
+
 ## [0.0.5] - 2026-06-26
 
 - Add `skill-master-update` to update the global npm installation safely outside the MCP stdio process.

package/README.md

@@ -81,6 +81,8 @@ Bootstrap direto pelo pacote, para maquinas que ja conseguem resolver o escopo `
 - PowerShell: `$env:GITHUB_PACKAGES_TOKEN='SEU_TOKEN'; npx -y -p @fprad0/skill-master-mcp skill-master-configure-private-registry --validate`
 - Bash: `GITHUB_PACKAGES_TOKEN='SEU_TOKEN' npx -y -p @fprad0/skill-master-mcp skill-master-configure-private-registry --validate`
 
+Por padrao, o configurador grava o `.npmrc` usando `${GITHUB_PACKAGES_TOKEN}` em vez de persistir o token literal. Para ambientes que exigem token gravado no arquivo, use `--store-token` de forma consciente.
+
 Exemplo de `.npmrc`:
 
 ```ini
@@ -108,8 +110,8 @@ npx -y @fprad0/skill-master-mcp@latest
 
 Estado atual validado em `2026-06-26`:
 
-- pacote publico publicado: `@fprad0/skill-master-mcp@0.0.5`
-- dist-tag `latest` apontando para `0.0.5`
+- pacote publico publicado: `@fprad0/skill-master-mcp@0.0.7`
+- dist-tag `latest` apontando para `0.0.7`
 - workflow `Publish Skill Master to npmjs` concluido com sucesso
 - `npm install` e `npx` confirmados
 
@@ -128,6 +130,16 @@ O `skill-master-mcp` deve continuar reservado para clientes MCP via `stdio`. Par
 skill-master-menu
 ```
 
+O menu agora possui modo visual interativo para terminal com TTY e tambem aceita execucao direta por acao:
+
+```bash
+skill-master-menu --run status
+skill-master-menu --run check
+skill-master-menu --run update --yes
+```
+
+O menu visual usa `prompts` para ficar mais legivel no terminal e manter compatibilidade com `Node 18+`.
+
 Para atualizar a instalacao global via npm sem iniciar o servidor MCP:
 
 ```bash

package/VERSION.md

@@ -2,8 +2,8 @@
 
 Versão funcional planejada: `00.02`
 
-Versão técnica para empacotamento semântico: `0.0.5`
+Versão técnica para empacotamento semântico: `0.0.7`
 
 ## Observação
 
-O nome `00.02` será usado na comunicação e nos documentos. Para ferramentas que exigem SemVer, como npm e alguns fluxos de release, usar `0.0.5`.
+O nome `00.02` será usado na comunicação e nos documentos. Para ferramentas que exigem SemVer, como npm e alguns fluxos de release, usar `0.0.7`.

package/bin/lib/menu-core.mjs

@@ -0,0 +1,227 @@
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import process from 'node:process';
+
+const ANSI = {
+  reset: '\x1b[0m',
+  bold: '\x1b[1m',
+  dim: '\x1b[2m',
+  cyan: '\x1b[36m',
+  green: '\x1b[32m',
+  yellow: '\x1b[33m',
+  red: '\x1b[31m',
+};
+
+function colorize(text, color, enabled) {
+  return enabled ? `${color}${text}${ANSI.reset}` : text;
+}
+
+export function readJson(rootDir, relativePath) {
+  const target = join(rootDir, relativePath);
+  if (!existsSync(target)) {
+    return null;
+  }
+
+  return JSON.parse(readFileSync(target, 'utf8'));
+}
+
+export function readText(rootDir, relativePath) {
+  const target = join(rootDir, relativePath);
+  if (!existsSync(target)) {
+    return null;
+  }
+
+  return readFileSync(target, 'utf8').trim();
+}
+
+export function getMenuStatus(rootDir) {
+  const packageJson = readJson(rootDir, 'package.json');
+  const stableManifest = readJson(rootDir, 'manifests/channels/stable.json');
+  const versionText = readText(rootDir, 'VERSION.md');
+
+  return {
+    packageName: packageJson?.name ?? 'nao encontrado',
+    semver: packageJson?.version ?? 'nao encontrado',
+    manifestVersion: stableManifest?.version ?? 'nao encontrado',
+    manifestSemver: stableManifest?.semver ?? 'nao encontrado',
+    versionText,
+    rootDir,
+  };
+}
+
+export function buildMenuCommands({ rootDir, currentFile, nodeExecPath = process.execPath }) {
+  return [
+    {
+      key: 'status',
+      aliases: ['status'],
+      label: 'Status local',
+      description: 'Mostra versao local, manifesto e informacoes do pacote.',
+      command: nodeExecPath,
+      args: [currentFile, '--status'],
+    },
+    {
+      key: 'check',
+      aliases: ['check', 'gate'],
+      label: 'Rodar gate completo',
+      description: 'Executa build, testes e validacao de manifestos.',
+      command: 'npm',
+      args: ['run', 'check'],
+    },
+    {
+      key: 'build',
+      aliases: ['build'],
+      label: 'Rodar build',
+      description: 'Compila o projeto localmente.',
+      command: 'npm',
+      args: ['run', 'build'],
+    },
+    {
+      key: 'publicNpm',
+      aliases: ['public-npm', 'npm', 'registry'],
+      label: 'Validar pacote no npm publico',
+      description: 'Consulta a versao publicada em registry.npmjs.org.',
+      command: 'npm',
+      args: [
+        'view',
+        '@fprad0/skill-master-mcp',
+        'version',
+        '--registry=https://registry.npmjs.org',
+      ],
+    },
+    {
+      key: 'updateGlobal',
+      aliases: ['update', 'update-global'],
+      label: 'Atualizar pacote global via npm',
+      description: 'Atualiza a instalacao global e exige reinicio do cliente MCP.',
+      command: nodeExecPath,
+      args: [join(rootDir, 'bin', 'skill-master-update.mjs')],
+      confirmMessage: 'Atualizar o pacote global agora?',
+    },
+    {
+      key: 'privateRegistry',
+      aliases: ['private-registry', 'private', 'github-packages'],
+      label: 'Configurar registry privado GitHub Packages',
+      description: 'Prepara o .npmrc e valida o acesso ao pacote privado.',
+      command: nodeExecPath,
+      args: ['scripts/configure-private-registry.mjs', '--validate'],
+      confirmMessage: 'Rodar a configuracao de registry privado agora?',
+    },
+  ];
+}
+
+export function buildMenuChoices(commands) {
+  return commands.map((command) => ({
+    title: command.label,
+    description: command.description,
+    value: command.key,
+  })).concat({
+    title: 'Sair',
+    description: 'Fecha o menu operacional.',
+    value: '__exit__',
+  });
+}
+
+export function resolveActionKey(input, commands) {
+  const normalized = (input ?? '').trim().toLowerCase();
+  if (!normalized) {
+    return null;
+  }
+
+  return commands.find((command) =>
+    command.key.toLowerCase() === normalized || command.aliases.includes(normalized),
+  )?.key ?? null;
+}
+
+export function isInteractiveTerminal() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+
+export function formatStatusReport(status) {
+  const lines = [
+    'Skill Master MCP - status local',
+    `Diretorio: ${status.rootDir}`,
+    `Pacote: ${status.packageName}`,
+    `Semver local: ${status.semver}`,
+    `Manifesto stable: ${status.manifestVersion}`,
+    `Manifesto semver: ${status.manifestSemver}`,
+  ];
+
+  if (status.versionText) {
+    lines.push('', 'VERSION.md:');
+    lines.push(...status.versionText.split('\n').slice(0, 6));
+  }
+
+  return lines.join('\n');
+}
+
+function renderPanelLines(lines, { color = ANSI.cyan, useColor = false } = {}) {
+  const width = Math.max(...lines.map((line) => line.length), 24);
+  const border = `+${'-'.repeat(width + 2)}+`;
+  const paintedBorder = colorize(border, color, useColor);
+  const body = lines.map((line) => `| ${line.padEnd(width)} |`);
+  return [paintedBorder, ...body, paintedBorder].join('\n');
+}
+
+export function formatMenuBanner(status, { useColor = false } = {}) {
+  const lines = [
+    colorize('Skill Master MCP', ANSI.bold, useColor),
+    'Menu operacional para manutencao local',
+    `Versao local ${status.semver}  |  canal ${status.manifestVersion}`,
+    colorize('Setas + Enter para navegar', ANSI.dim, useColor),
+  ];
+  return renderPanelLines(lines, { color: ANSI.cyan, useColor });
+}
+
+export function formatActionHeader(action, { useColor = false } = {}) {
+  return renderPanelLines(
+    [
+      colorize(action.label, ANSI.bold, useColor),
+      action.description,
+    ],
+    { color: ANSI.green, useColor },
+  );
+}
+
+export function formatResultMessage(code, { useColor = false } = {}) {
+  if (code === 0) {
+    return colorize('Comando concluido com sucesso.', ANSI.green, useColor);
+  }
+
+  return colorize(`Comando terminou com codigo ${code}.`, ANSI.red, useColor);
+}
+
+export function formatHelp(commands) {
+  const actionList = commands.map((command) => `  - ${command.key}: ${command.label}`).join('\n');
+
+  return `Skill Master Menu
+
+Uso:
+  skill-master-menu
+  skill-master-menu --status
+  skill-master-menu --run <acao>
+  skill-master-menu --run update --yes
+  skill-master-menu --help
+
+Acoes disponiveis:
+${actionList}
+
+O comando de menu e voltado para operacao humana. O binario MCP stdio continua sendo:
+  skill-master-mcp
+`;
+}
+
+export function runCommand(action, { cwd, env = process.env } = {}) {
+  return new Promise((resolve) => {
+    const child = spawn(action.command, action.args, {
+      cwd,
+      env,
+      shell: process.platform === 'win32',
+      stdio: 'inherit',
+    });
+
+    child.on('close', (code) => {
+      resolve(code ?? 1);
+    });
+  });
+}

package/bin/skill-master-menu.mjs

@@ -1,179 +1,172 @@
 #!/usr/bin/env node
 
-import { spawn } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
+import prompts from 'prompts';
+import { dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { createInterface } from 'node:readline/promises';
-import { stdin as input, stdout as output } from 'node:process';
-
-const rootDir = dirname(dirname(fileURLToPath(import.meta.url)));
-
-const commands = {
-  status: {
-    label: 'Mostrar status local',
-    command: process.execPath,
-    args: [fileURLToPath(import.meta.url), '--status'],
-  },
-  check: {
-    label: 'Rodar gate completo',
-    command: 'npm',
-    args: ['run', 'check'],
-  },
-  build: {
-    label: 'Rodar build',
-    command: 'npm',
-    args: ['run', 'build'],
-  },
-  publicNpm: {
-    label: 'Validar pacote no npm publico',
-    command: 'npm',
-    args: [
-      'view',
-      '@fprad0/skill-master-mcp',
-      'version',
-      '--registry=https://registry.npmjs.org',
-    ],
-  },
-  updateGlobal: {
-    label: 'Atualizar pacote global via npm',
-    command: process.execPath,
-    args: [join(rootDir, 'bin', 'skill-master-update.mjs')],
-  },
-  privateRegistry: {
-    label: 'Configurar registry privado GitHub Packages',
-    command: process.execPath,
-    args: ['scripts/configure-private-registry.mjs', '--validate'],
-  },
-};
-
-const menuItems = [
-  ['1', commands.status],
-  ['2', commands.check],
-  ['3', commands.build],
-  ['4', commands.publicNpm],
-  ['5', commands.updateGlobal],
-  ['6', commands.privateRegistry],
-];
-
-function readJson(relativePath) {
-  const target = join(rootDir, relativePath);
-  if (!existsSync(target)) {
-    return null;
+import {
+  buildMenuChoices,
+  buildMenuCommands,
+  formatActionHeader,
+  formatHelp,
+  formatMenuBanner,
+  formatResultMessage,
+  formatStatusReport,
+  getMenuStatus,
+  isInteractiveTerminal,
+  resolveActionKey,
+  runCommand,
+} from './lib/menu-core.mjs';
+
+const currentFile = fileURLToPath(import.meta.url);
+const rootDir = dirname(dirname(currentFile));
+const commands = buildMenuCommands({ rootDir, currentFile });
+
+function parseArgs(argv) {
+  const parsed = {
+    help: false,
+    status: false,
+    yes: false,
+    run: null,
+  };
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    switch (arg) {
+      case '--help':
+      case '-h':
+        parsed.help = true;
+        break;
+      case '--status':
+        parsed.status = true;
+        break;
+      case '--yes':
+        parsed.yes = true;
+        break;
+      case '--run':
+        parsed.run = argv[++i] ?? null;
+        break;
+      default:
+        throw new Error(`Unknown argument: ${arg}`);
+    }
   }
 
-  return JSON.parse(readFileSync(target, 'utf8'));
+  return parsed;
 }
 
-function readText(relativePath) {
-  const target = join(rootDir, relativePath);
-  if (!existsSync(target)) {
-    return null;
-  }
+function printHelp() {
+  console.log(formatHelp(commands));
+}
 
-  return readFileSync(target, 'utf8').trim();
+function printStatus() {
+  console.log(formatStatusReport(getMenuStatus(rootDir)));
 }
 
-function printHelp() {
-  console.log(`Skill Master Menu
+async function runSelectedAction(action, { yes = false, useColor = false } = {}) {
+  if (action.confirmMessage && !yes) {
+    if (!isInteractiveTerminal()) {
+      throw new Error(`Action ${action.key} requires --yes outside an interactive terminal.`);
+    }
 
-Uso:
-  skill-master-menu
-  skill-master-menu --status
-  skill-master-menu --help
+    const confirmation = await prompts({
+      type: 'confirm',
+      name: 'confirmed',
+      message: action.confirmMessage,
+      initial: false,
+    });
 
-Opcao 5 do menu:
-  atualiza o pacote global com npm install -g @fprad0/skill-master-mcp@latest
+    if (!confirmation.confirmed) {
+      return { cancelled: true, code: 0 };
+    }
+  }
 
-O comando de menu e voltado para operacao humana. O binario MCP stdio continua sendo:
-  skill-master-mcp
-`);
+  console.log('');
+  console.log(formatActionHeader(action, { useColor }));
+  console.log('');
+  const code = await runCommand(action, { cwd: rootDir });
+  console.log('');
+  console.log(formatResultMessage(code, { useColor }));
+  return { cancelled: false, code };
 }
 
-function printStatus() {
-  const packageJson = readJson('package.json');
-  const stableManifest = readJson('manifests/channels/stable.json');
-  const versionText = readText('VERSION.md');
-
-  console.log('Skill Master MCP - status local');
-  console.log(`Diretorio: ${rootDir}`);
-  console.log(`Pacote: ${packageJson?.name ?? 'nao encontrado'}`);
-  console.log(`Semver local: ${packageJson?.version ?? 'nao encontrado'}`);
-  console.log(`Manifesto stable: ${stableManifest?.version ?? 'nao encontrado'}`);
-  console.log(`Manifesto semver: ${stableManifest?.semver ?? 'nao encontrado'}`);
-
-  if (versionText) {
-    const firstLines = versionText.split('\n').slice(0, 6).join('\n');
-    console.log('\nVERSION.md:');
-    console.log(firstLines);
-  }
-}
+async function runVisualMenu() {
+  while (true) {
+    console.clear();
+    const status = getMenuStatus(rootDir);
+    console.log(formatMenuBanner(status, { useColor: true }));
+    console.log('');
+
+    const selection = await prompts({
+      type: 'select',
+      name: 'action',
+      message: 'Escolha uma acao',
+      choices: buildMenuChoices(commands),
+      initial: 0,
+    });
 
-function runCommand(commandConfig) {
-  return new Promise((resolve) => {
-    console.log(`\n> ${commandConfig.command} ${commandConfig.args.join(' ')}\n`);
+    if (!selection.action || selection.action === '__exit__') {
+      return 0;
+    }
 
-    const child = spawn(commandConfig.command, commandConfig.args, {
-      cwd: rootDir,
-      env: process.env,
-      shell: process.platform === 'win32',
-      stdio: 'inherit',
-    });
+    const action = commands.find((entry) => entry.key === selection.action);
+    if (!action) {
+      return 1;
+    }
 
-    child.on('close', (code) => {
-      resolve(code ?? 1);
+    const result = await runSelectedAction(action, { useColor: true });
+    if (result.cancelled) {
+      continue;
+    }
+
+    const nextStep = await prompts({
+      type: 'toggle',
+      name: 'keepGoing',
+      message: 'Voltar ao menu?',
+      initial: true,
+      active: 'sim',
+      inactive: 'nao',
     });
-  });
-}
 
-async function runInteractiveMenu() {
-  const rl = createInterface({ input, output });
-
-  try {
-    while (true) {
-      console.log('\nSkill Master Menu');
-      for (const [key, item] of menuItems) {
-        console.log(`  ${key}. ${item.label}`);
-      }
-      console.log('  0. Sair');
-
-      const answer = (await rl.question('\nEscolha uma opcao: ')).trim();
-
-      if (answer === '0' || answer.toLowerCase() === 'q') {
-        return 0;
-      }
-
-      const selected = menuItems.find(([key]) => key === answer)?.[1];
-      if (!selected) {
-        console.log('Opcao invalida.');
-        continue;
-      }
-
-      const code = await runCommand(selected);
-      if (code !== 0) {
-        console.log(`\nComando terminou com codigo ${code}.`);
-      }
+    if (!nextStep.keepGoing) {
+      return result.code;
     }
-  } finally {
-    rl.close();
   }
 }
 
 async function main() {
-  const args = process.argv.slice(2);
+  const args = parseArgs(process.argv.slice(2));
 
-  if (args.includes('--help') || args.includes('-h')) {
+  if (args.help) {
     printHelp();
     return 0;
   }
 
-  if (args.includes('--status')) {
+  if (args.status) {
     printStatus();
     return 0;
   }
 
-  return runInteractiveMenu();
+  if (args.run) {
+    const actionKey = resolveActionKey(args.run, commands);
+    if (!actionKey) {
+      throw new Error(`Unknown action: ${args.run}`);
+    }
+
+    const action = commands.find((entry) => entry.key === actionKey);
+    const result = await runSelectedAction(action, { yes: args.yes, useColor: isInteractiveTerminal() });
+    return result.code;
+  }
+
+  if (!isInteractiveTerminal()) {
+    throw new Error('Interactive menu requires a TTY. Use --run <acao> or --status in automated environments.');
+  }
+
+  return runVisualMenu();
 }
 
-const exitCode = await main();
-process.exitCode = exitCode;
+try {
+  process.exitCode = await main();
+} catch (error) {
+  const message = error instanceof Error ? error.message : String(error);
+  process.stderr.write(`[skill_master] ${message}\n`);
+  process.exitCode = 1;
+}

package/docs/operations/GUIA_NPM_PRIVADO.md

@@ -11,6 +11,23 @@ O fluxo usa:
 - execucao via `npx @fprad0/skill-master-mcp`;
 - configuracao MCP por `stdio`.
 
+## Modelo de seguranca do `.npmrc`
+
+O configurador segue tres regras:
+
+- o token fica escopado ao host do registry, por exemplo `//npm.pkg.github.com/:_authToken=...`;
+- o registry precisa usar HTTPS por padrao;
+- o arquivo `.npmrc` usa referencia de variavel de ambiente por padrao, evitando gravar o token literal.
+
+Conteudo recomendado:
+
+```ini
+@fprad0:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${GITHUB_PACKAGES_TOKEN}
+```
+
+Se voce precisar persistir o token literal dentro do `.npmrc`, use `--store-token` de forma consciente. Esse modo e menos seguro, mas pode ser necessario em maquinas sem suporte simples a variaveis de ambiente persistentes.
+
 ## Pre-requisitos
 
 - Node.js e npm instalados;
@@ -65,7 +82,8 @@ O script:
 
 - pede o token de forma segura se ele no estiver em variavel de ambiente;
 - atualiza apenas as linhas necessrias do `%USERPROFILE%\.npmrc`;
-- cria backup em `%USERPROFILE%\.npmrc.bak` se o arquivo j existir;
+- cria backup com timestamp se o arquivo ja existir;
+- grava o `.npmrc` apontando para `${GITHUB_PACKAGES_TOKEN}` por padrao;
 - valida acesso ao pacote com `npm view`;
 - mostra o comando final de `npx`.
 
@@ -75,11 +93,17 @@ Crie ou atualize o arquivo:
 %USERPROFILE%\.npmrc
 ```
 
-Com o conteudo:
+Com o conteudo recomendado:
 
 ```ini
 @fprad0:registry=https://npm.pkg.github.com
-//npm.pkg.github.com/:_authToken=SEU_TOKEN_AQUI
+//npm.pkg.github.com/:_authToken=${GITHUB_PACKAGES_TOKEN}
+```
+
+Se preferir gravar o token literal no `.npmrc`:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File .\scripts\configure-private-registry.ps1 -Validate -StoreToken
 ```
 
 ### Jeito rapido sem checkout local
@@ -91,6 +115,12 @@ $env:GITHUB_PACKAGES_TOKEN='SEU_TOKEN'
 npx -y -p @fprad0/skill-master-mcp skill-master-configure-private-registry --validate
 ```
 
+Para ler o token de arquivo, evitando argumento em historico de shell:
+
+```powershell
+npx -y -p @fprad0/skill-master-mcp skill-master-configure-private-registry --token-file .\github-packages-token.txt --validate
+```
+
 ## Validar acesso ao pacote
 
 ```bat
@@ -112,6 +142,8 @@ O script:
 - pede o token sem eco no terminal quando necessario;
 - atualiza apenas as linhas do escopo `@fprad0`;
 - cria ou reaproveita `${HOME}/.npmrc`;
+- aplica permissao `0600` no `${HOME}/.npmrc`;
+- grava o `.npmrc` apontando para `${GITHUB_PACKAGES_TOKEN}` por padrao;
 - valida acesso ao pacote;
 - mostra o comando final de `npx`.
 
@@ -123,6 +155,18 @@ Use esta opcao quando a maquina ja consegue resolver o escopo `@fprad0` no GitHu
 GITHUB_PACKAGES_TOKEN='SEU_TOKEN' npx -y -p @fprad0/skill-master-mcp skill-master-configure-private-registry --validate
 ```
 
+Para ler o token via stdin:
+
+```bash
+printf '%s' "$GITHUB_PACKAGES_TOKEN" | npx -y -p @fprad0/skill-master-mcp skill-master-configure-private-registry --token-stdin --validate
+```
+
+Para gravar token literal no `.npmrc` quando necessario:
+
+```bash
+bash ./scripts/configure-private-registry.sh --validate --store-token
+```
+
 ## Publicacao pelo workflow
 
 O workflow de release usa:

package/manifests/channels/beta.json

@@ -2,12 +2,12 @@
   "name": "skill_master",
   "channel": "beta",
   "version": "00.02-beta",
-  "semver": "0.0.5",
-  "publishedAt": "2026-06-26T14:35:00-03:00",
+  "semver": "0.0.7",
+  "publishedAt": "2026-06-26T20:15:00-03:00",
   "git": {
     "repo": "https://github.com/FPrad0/skill-master-mcp",
     "branch": "main",
-    "commit": "af41244"
+    "commit": "ec57c95"
   },
   "node": {
     "minimum": "18.0.0"
@@ -19,7 +19,7 @@
     "buildCommand": "npm run build"
   },
   "changelog": [
-    "Canal beta acompanha o novo comando skill-master-update.",
-    "Update npm fica disponivel via comando separado e pelo menu operacional."
+    "Canal beta acompanha o menu visual no terminal.",
+    "Fluxo interativo agora tem selecao visual, confirmacao e modo direto por acao."
   ]
 }

package/manifests/channels/stable.json

@@ -2,12 +2,12 @@
   "name": "skill_master",
   "channel": "stable",
   "version": "00.02",
-  "semver": "0.0.5",
-  "publishedAt": "2026-06-26T14:35:00-03:00",
+  "semver": "0.0.7",
+  "publishedAt": "2026-06-26T20:15:00-03:00",
   "git": {
     "repo": "https://github.com/FPrad0/skill-master-mcp",
     "branch": "main",
-    "commit": "af41244"
+    "commit": "ec57c95"
   },
   "node": {
     "minimum": "18.0.0"
@@ -19,8 +19,8 @@
     "buildCommand": "npm run build"
   },
   "changelog": [
-    "Novo binario skill-master-update para atualizar instalacao global via npm.",
-    "Menu operacional passa a incluir opcao de update global seguro.",
-    "Fluxo evita atualizar arquivos durante execucao do servidor MCP stdio."
+    "Menu operacional ganha interface visual no terminal com prompts.",
+    "Core do menu foi extraido para modulo reutilizavel e testavel.",
+    "Compatibilidade Node 18+ foi preservada sem migrar para TUI pesada."
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fprad0/skill-master-mcp",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "private": false,
   "type": "module",
   "description": "Personal MCP server that catalogs, recommends and reports skills with update-aware metadata.",
@@ -51,6 +51,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
+    "prompts": "^2.4.2",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/scripts/configure-private-registry.mjs

@@ -1,14 +1,39 @@
 import { spawnSync } from 'node:child_process';
-import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import {
   DEFAULT_PACKAGE_NAME,
   DEFAULT_REGISTRY_URL,
   DEFAULT_SCOPE,
   DEFAULT_TOKEN_ENV,
+  redactSensitiveNpmrc,
   upsertNpmrc,
 } from './lib/private-registry.mjs';
 
+function printHelp() {
+  process.stdout.write(`Skill Master private registry configurator
+
+Usage:
+  skill-master-configure-private-registry [options]
+
+Options:
+  --npmrc <path>              Target .npmrc path. Defaults to the user .npmrc.
+  --scope <scope>             npm scope. Defaults to @fprad0.
+  --registry <url>            Registry URL. Defaults to https://npm.pkg.github.com.
+  --token <token>             Token for validation. Avoid in shared shell history.
+  --token-file <path>         Read token from a local file.
+  --token-stdin               Read token from stdin.
+  --token-env <name>          Environment variable name. Defaults to GITHUB_PACKAGES_TOKEN.
+  --store-token               Persist the token literal in .npmrc. Default stores \${TOKEN_ENV}.
+  --allow-insecure-registry   Allow http only for localhost/private test registries.
+  --no-backup                 Do not create a timestamped backup.
+  --dry-run                   Print a redacted preview without writing.
+  --validate                  Run npm view after writing.
+  --package <name>            Package used for validation.
+  --help                      Show this help.
+`);
+}
+
 function parseArgs(argv) {
   const parsed = {
     npmrc: resolve(process.env.USERPROFILE ?? process.env.HOME ?? '.', '.npmrc'),
@@ -19,6 +44,9 @@ function parseArgs(argv) {
     dryRun: false,
     validate: false,
     packageName: DEFAULT_PACKAGE_NAME,
+    storeToken: false,
+    allowInsecureRegistry: false,
+    help: false,
   };
 
   for (let i = 0; i < argv.length; i += 1) {
@@ -36,9 +64,21 @@ function parseArgs(argv) {
       case '--token':
         parsed.token = argv[++i];
         break;
+      case '--token-file':
+        parsed.tokenFile = resolve(argv[++i]);
+        break;
+      case '--token-stdin':
+        parsed.tokenStdin = true;
+        break;
       case '--token-env':
         parsed.tokenEnv = argv[++i];
         break;
+      case '--store-token':
+        parsed.storeToken = true;
+        break;
+      case '--allow-insecure-registry':
+        parsed.allowInsecureRegistry = true;
+        break;
       case '--no-backup':
         parsed.backup = false;
         break;
@@ -51,6 +91,10 @@ function parseArgs(argv) {
       case '--package':
         parsed.packageName = argv[++i];
         break;
+      case '--help':
+      case '-h':
+        parsed.help = true;
+        break;
       default:
         throw new Error(`Unknown argument: ${arg}`);
     }
@@ -59,12 +103,39 @@ function parseArgs(argv) {
   return parsed;
 }
 
+function readToken(options) {
+  if (options.token) {
+    return options.token;
+  }
+
+  if (options.tokenFile) {
+    return readFileSync(options.tokenFile, 'utf8').trim();
+  }
+
+  if (options.tokenStdin) {
+    return readFileSync(0, 'utf8').trim();
+  }
+
+  return process.env[options.tokenEnv];
+}
+
+function buildBackupPath(npmrcPath) {
+  const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+  return `${npmrcPath}.bak.${timestamp}`;
+}
+
 function main() {
   const options = parseArgs(process.argv.slice(2));
-  const token = options.token ?? process.env[options.tokenEnv];
 
-  if (!token) {
-    throw new Error(`Token not provided. Use --token or define ${options.tokenEnv}.`);
+  if (options.help) {
+    printHelp();
+    return;
+  }
+
+  const token = readToken(options);
+  const needsToken = options.storeToken || options.validate;
+  if (needsToken && !token) {
+    throw new Error(`Token not provided. Use --token-file, --token-stdin, --token, or define ${options.tokenEnv}.`);
   }
 
   const currentContent = existsSync(options.npmrc)
@@ -75,16 +146,24 @@ function main() {
     scope: options.scope,
     registryUrl: options.registry,
     tokenValue: token,
+    tokenEnv: options.tokenEnv,
+    storeToken: options.storeToken,
+    allowInsecureRegistry: options.allowInsecureRegistry,
   });
 
   const changed = nextContent !== currentContent.replace(/\r\n/g, '\n');
 
-  if (!options.dryRun) {
+  if (options.dryRun) {
+    process.stdout.write(redactSensitiveNpmrc(nextContent));
+  } else {
     mkdirSync(dirname(options.npmrc), { recursive: true });
     if (changed && options.backup && existsSync(options.npmrc)) {
-      copyFileSync(options.npmrc, `${options.npmrc}.bak`);
+      copyFileSync(options.npmrc, buildBackupPath(options.npmrc));
     }
     writeFileSync(options.npmrc, nextContent, 'utf8');
+    if (process.platform !== 'win32') {
+      chmodSync(options.npmrc, 0o600);
+    }
   }
 
   if (options.validate) {
@@ -95,7 +174,11 @@ function main() {
     const result = spawnSync(
       'npm',
       ['view', options.packageName, `--registry=${options.registry}`],
-      { stdio: 'inherit', shell: process.platform === 'win32' },
+      {
+        env: { ...process.env, [options.tokenEnv]: token },
+        stdio: 'inherit',
+        shell: process.platform === 'win32',
+      },
     );
 
     if (result.status !== 0) {
@@ -108,6 +191,7 @@ function main() {
       `[skill_master] ${options.dryRun ? 'Preview ready for' : 'Configured'} ${options.npmrc}`,
       `[skill_master] Scope: ${options.scope}`,
       `[skill_master] Registry: ${options.registry}`,
+      `[skill_master] Token storage: ${options.storeToken ? 'literal token in .npmrc' : `environment reference \${${options.tokenEnv}}`}`,
       `[skill_master] Changed: ${changed ? 'yes' : 'no'}`,
       `[skill_master] Validate with: npm view ${options.packageName} --registry=${options.registry}`,
       `[skill_master] Run with: npx -y ${options.packageName}@latest`,

package/scripts/lib/private-registry.mjs

@@ -3,30 +3,68 @@ export const DEFAULT_PACKAGE_NAME = '@fprad0/skill-master-mcp';
 export const DEFAULT_REGISTRY_URL = 'https://npm.pkg.github.com';
 export const DEFAULT_TOKEN_ENV = 'GITHUB_PACKAGES_TOKEN';
 
-export function registryHostFromUrl(registryUrl = DEFAULT_REGISTRY_URL) {
-  return new URL(registryUrl).host;
+export function normalizeRegistryUrl(registryUrl = DEFAULT_REGISTRY_URL, { allowInsecure = false } = {}) {
+  const parsed = new URL(registryUrl);
+  const isLocalhost = ['localhost', '127.0.0.1', '::1'].includes(parsed.hostname);
+
+  if (parsed.protocol !== 'https:' && !(allowInsecure && isLocalhost)) {
+    throw new Error(`Registry must use HTTPS: ${registryUrl}`);
+  }
+
+  parsed.hash = '';
+  parsed.search = '';
+  return parsed.toString().replace(/\/$/, '');
+}
+
+export function registryHostFromUrl(registryUrl = DEFAULT_REGISTRY_URL, { allowInsecure = false } = {}) {
+  return new URL(normalizeRegistryUrl(registryUrl, { allowInsecure })).host;
 }
 
 export function buildRegistryLine(scope = DEFAULT_SCOPE, registryUrl = DEFAULT_REGISTRY_URL) {
-  return `${scope}:registry=${registryUrl}`;
+  return `${scope}:registry=${normalizeRegistryUrl(registryUrl)}`;
 }
 
 export function buildTokenLine(registryUrl = DEFAULT_REGISTRY_URL, tokenValue) {
   return `//${registryHostFromUrl(registryUrl)}/:_authToken=${tokenValue}`;
 }
 
+export function buildTokenEnvReference(tokenEnv = DEFAULT_TOKEN_ENV) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(tokenEnv)) {
+    throw new Error(`Invalid token environment variable name: ${tokenEnv}`);
+  }
+
+  return '${' + tokenEnv + '}';
+}
+
+export function validateScope(scope = DEFAULT_SCOPE) {
+  if (!/^@[a-z0-9][a-z0-9._-]*$/i.test(scope)) {
+    throw new Error(`Invalid npm scope: ${scope}`);
+  }
+
+  return scope;
+}
+
 export function upsertNpmrc(content, {
   scope = DEFAULT_SCOPE,
   registryUrl = DEFAULT_REGISTRY_URL,
   tokenValue,
+  tokenEnv = DEFAULT_TOKEN_ENV,
+  storeToken = false,
+  allowInsecureRegistry = false,
 } = {}) {
-  if (!tokenValue) {
-    throw new Error('tokenValue is required');
+  const normalizedScope = validateScope(scope);
+  const normalizedRegistryUrl = normalizeRegistryUrl(registryUrl, { allowInsecure: allowInsecureRegistry });
+  const tokenValueForFile = storeToken
+    ? tokenValue
+    : buildTokenEnvReference(tokenEnv);
+
+  if (!tokenValueForFile) {
+    throw new Error(storeToken ? 'tokenValue is required when storeToken is enabled' : 'tokenEnv is required');
   }
 
   const existing = (content ?? '').replace(/\r\n/g, '\n');
-  const registryLinePrefix = `${scope}:registry=`;
-  const tokenLinePrefix = `//${registryHostFromUrl(registryUrl)}/:_authToken=`;
+  const registryLinePrefix = `${normalizedScope}:registry=`;
+  const tokenLinePrefix = `//${registryHostFromUrl(normalizedRegistryUrl, { allowInsecure: allowInsecureRegistry })}/:_authToken=`;
 
   const filteredLines = existing
     .split('\n')
@@ -40,8 +78,8 @@ export function upsertNpmrc(content, {
     filteredLines.push('');
   }
 
-  filteredLines.push(buildRegistryLine(scope, registryUrl));
-  filteredLines.push(buildTokenLine(registryUrl, tokenValue));
+  filteredLines.push(buildRegistryLine(normalizedScope, normalizedRegistryUrl));
+  filteredLines.push(buildTokenLine(normalizedRegistryUrl, tokenValueForFile));
 
   return `${filteredLines.join('\n')}\n`;
 }
@@ -54,3 +92,6 @@ export function hasRegistryConfig(content, {
   return normalized.includes(buildRegistryLine(scope, registryUrl));
 }
 
+export function redactSensitiveNpmrc(content) {
+  return (content ?? '').replace(/(:_authToken=)(.+)$/gm, '$1<redacted>');
+}