@growthub/cli 0.6.0 → 0.6.2

package/dist/starter/source-import/security.js

@@ -0,0 +1,323 @@
+/**
+ * Source Import Agent — shared security inspector.
+ *
+ * Deterministic, bounded, read-only static analysis over a materialised
+ * source payload (cloned repo or unpacked skill). The inspector NEVER
+ * executes any script. It emits a `SourceSecurityReport` that:
+ *
+ *   - lists pattern-based findings (shell scripts, install hooks,
+ *     external downloads, prompt-injection patterns, env mutation,
+ *     privileged instructions, suspicious archives)
+ *   - aggregates a risk class (`safe` | `caution` | `high-risk` | `blocked`)
+ *   - produces short operator-facing summary lines rendered in the
+ *     confirmation prompt
+ *
+ * Two risk surfaces the caller uses downstream:
+ *
+ *   - `report.blocked` → agent MUST refuse to continue even on confirm.
+ *   - `report.riskClass !== "safe"` → plan flags the inspect action as
+ *     needing explicit confirmation.
+ *
+ * Skills imports ALWAYS require the inspection + confirmation, even when
+ * the report is "safe", because skills are agent primitives closer to
+ * executable content than generic repos.
+ */
+import fs from "node:fs";
+import path from "node:path";
+// ---------------------------------------------------------------------------
+// Bounds — keep the inspector deterministic and cheap
+// ---------------------------------------------------------------------------
+const MAX_FILES = 2000;
+const MAX_BYTES_PER_FILE = 256 * 1024; // 256 KiB
+const MAX_TOTAL_BYTES = 16 * 1024 * 1024; // 16 MiB
+const TEXT_EXTENSIONS = new Set([
+    ".md", ".mdx", ".markdown",
+    ".txt", ".json", ".yaml", ".yml", ".toml",
+    ".sh", ".bash", ".zsh", ".fish", ".ps1", ".bat", ".cmd",
+    ".py", ".rb", ".js", ".cjs", ".mjs", ".ts", ".tsx", ".jsx",
+    ".go", ".rs", ".java", ".kt", ".swift", ".c", ".cc", ".cpp", ".h", ".hpp",
+    ".html", ".htm", ".css", ".scss", ".sass", ".less",
+    ".xml", ".csv", ".ini", ".env", ".conf", ".cfg",
+    ".lock", ".gitignore", ".gitattributes",
+    ".dockerfile",
+]);
+const SUSPICIOUS_BINARY_EXTENSIONS = new Set([
+    ".exe", ".dll", ".so", ".dylib",
+    ".bin", ".app", ".msi",
+    ".apk", ".ipa",
+    ".jar", ".war",
+    ".dmg", ".pkg",
+]);
+const ARCHIVE_EXTENSIONS = new Set([
+    ".zip", ".tar", ".tgz", ".tar.gz", ".bz2", ".xz", ".7z", ".rar", ".gz",
+]);
+const TEXT_PATTERNS = [
+    {
+        category: "external-download",
+        severity: "high-risk",
+        regex: /\bcurl\s+[^|\n]*\|\s*(sudo\s+)?(sh|bash|zsh|ksh|fish)\b/i,
+        message: "Pipes remote content directly into a shell interpreter.",
+    },
+    {
+        category: "external-download",
+        severity: "high-risk",
+        regex: /\bwget\s+[^|\n]*\|\s*(sudo\s+)?(sh|bash|zsh|ksh|fish)\b/i,
+        message: "Pipes a wget download directly into a shell interpreter.",
+    },
+    {
+        category: "privileged-instruction",
+        severity: "high-risk",
+        regex: /\bsudo\s+rm\s+-rf?\s+\/(?!home|Users|tmp)/i,
+        message: "Invokes sudo rm -rf on a root-adjacent path.",
+    },
+    {
+        category: "privileged-instruction",
+        severity: "blocking",
+        regex: /\brm\s+-rf\s+\/(?:\s|$)/i,
+        message: "Attempts to recursively delete the filesystem root.",
+    },
+    {
+        category: "privileged-instruction",
+        severity: "caution",
+        regex: /\bchmod\s+\+s\b/i,
+        message: "Sets the setuid/setgid bit — requires explicit review.",
+    },
+    {
+        category: "env-mutation",
+        severity: "caution",
+        regex: /\bexport\s+[A-Z_]+\s*=/,
+        message: "Mutates shell environment variables.",
+    },
+    {
+        category: "network-heavy-setup",
+        severity: "caution",
+        regex: /\bnpm\s+install\s+-g\b|\bpnpm\s+add\s+-g\b|\byarn\s+global\s+add\b/i,
+        message: "Installs a package globally during setup.",
+    },
+    {
+        category: "install-hook",
+        severity: "caution",
+        regex: /"(preinstall|postinstall|prepare|install)"\s*:/,
+        message: "Declares an npm lifecycle install hook that can run on `npm install`.",
+    },
+    {
+        category: "prompt-injection",
+        severity: "caution",
+        regex: /\b(ignore|disregard|forget)\s+(all\s+)?previous\s+(instructions|rules|prompts?)\b/i,
+        message: "Prompt-injection pattern — text asks the agent to discard prior instructions.",
+    },
+    {
+        category: "prompt-injection",
+        severity: "caution",
+        regex: /\byou\s+are\s+now\s+(an?|the)\s+[a-z\s]+\s+(assistant|agent|model)\b/i,
+        message: "Prompt-injection pattern — text attempts a persona override.",
+    },
+    {
+        category: "prompt-injection",
+        severity: "high-risk",
+        regex: /system\s*:\s*override\s+(safety|guardrails?|policies)/i,
+        message: "Prompt-injection pattern — instructs the agent to override safety rules.",
+    },
+    {
+        category: "shell-script",
+        severity: "info",
+        regex: /^#!\s*\/(?:usr\/)?bin\/(?:env\s+)?(?:sh|bash|zsh|ksh|fish)\b/m,
+        message: "Executable shell script shebang.",
+    },
+    {
+        category: "external-download",
+        severity: "caution",
+        regex: /\bnpx\s+[^\s]+/i,
+        message: "Invokes npx on an arbitrary package.",
+    },
+];
+// ---------------------------------------------------------------------------
+// Traversal
+// ---------------------------------------------------------------------------
+function isLikelyTextFile(filename) {
+    const ext = path.extname(filename).toLowerCase();
+    if (!ext)
+        return true; // README, LICENSE, etc.
+    return TEXT_EXTENSIONS.has(ext);
+}
+function isSuspiciousBinary(filename) {
+    return SUSPICIOUS_BINARY_EXTENSIONS.has(path.extname(filename).toLowerCase());
+}
+function isUnexpectedArchive(filename) {
+    const ext = path.extname(filename).toLowerCase();
+    return ARCHIVE_EXTENSIONS.has(ext) || filename.toLowerCase().endsWith(".tar.gz");
+}
+function shortExcerpt(line) {
+    const trimmed = line.trim();
+    return trimmed.length <= 120 ? trimmed : `${trimmed.slice(0, 117)}...`;
+}
+function classify(findings) {
+    if (findings.some((f) => f.severity === "blocking"))
+        return "blocked";
+    if (findings.some((f) => f.severity === "high-risk"))
+        return "high-risk";
+    if (findings.some((f) => f.severity === "caution"))
+        return "caution";
+    return "safe";
+}
+function severityRank(sev) {
+    switch (sev) {
+        case "info": return 0;
+        case "caution": return 1;
+        case "high-risk": return 2;
+        case "blocking": return 3;
+    }
+}
+function summarise(findings, riskClass) {
+    if (findings.length === 0) {
+        return [`Risk: ${riskClass}. No security findings surfaced.`];
+    }
+    const byCategory = new Map();
+    for (const f of findings) {
+        byCategory.set(f.category, (byCategory.get(f.category) ?? 0) + 1);
+    }
+    const lines = [`Risk: ${riskClass}. ${findings.length} finding(s).`];
+    const ordered = Array.from(byCategory.entries()).sort(([, a], [, b]) => b - a);
+    for (const [cat, count] of ordered) {
+        lines.push(`  • ${cat}: ${count}`);
+    }
+    const top = [...findings]
+        .sort((a, b) => severityRank(b.severity) - severityRank(a.severity))
+        .slice(0, 3);
+    for (const f of top) {
+        lines.push(`  [${f.severity}] ${f.path} — ${f.message}`);
+    }
+    return lines;
+}
+function walkPayload(root, onFile, limits) {
+    let visited = 0;
+    const stack = [root];
+    while (stack.length > 0) {
+        if (visited >= limits.maxFiles)
+            break;
+        const current = stack.pop();
+        if (!current)
+            break;
+        let entries;
+        try {
+            entries = fs.readdirSync(current, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            const abs = path.resolve(current, entry.name);
+            // Skip .git and node_modules trees entirely — they are noise for
+            // the operator review and bloat the inspection budget.
+            if (entry.isDirectory()) {
+                if (entry.name === ".git" || entry.name === "node_modules")
+                    continue;
+                stack.push(abs);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            const rel = path.relative(root, abs);
+            onFile(abs, rel);
+            visited += 1;
+            if (visited >= limits.maxFiles)
+                break;
+        }
+    }
+    return visited;
+}
+/**
+ * Inspect a materialised source payload and return a
+ * `SourceSecurityReport`. Pure read-only.
+ */
+export function inspectSourcePayload(input) {
+    const { payloadRoot } = input;
+    if (!fs.existsSync(payloadRoot) || !fs.statSync(payloadRoot).isDirectory()) {
+        throw new Error(`Inspection target is not a directory: ${payloadRoot}`);
+    }
+    const findings = [];
+    let bytesInspected = 0;
+    const filesInspected = walkPayload(payloadRoot, (abs, rel) => {
+        let size = 0;
+        try {
+            size = fs.statSync(abs).size;
+        }
+        catch {
+            return;
+        }
+        if (isSuspiciousBinary(rel)) {
+            findings.push({
+                category: "suspicious-binary",
+                severity: "high-risk",
+                path: rel,
+                message: `Payload ships a precompiled binary (${path.extname(rel)}). Review provenance before use.`,
+            });
+            return;
+        }
+        if (isUnexpectedArchive(rel)) {
+            findings.push({
+                category: "unexpected-archive",
+                severity: "caution",
+                path: rel,
+                message: `Payload ships an archive (${path.extname(rel)}) — expand and review contents before use.`,
+            });
+            return;
+        }
+        if (!isLikelyTextFile(rel))
+            return;
+        if (bytesInspected + Math.min(size, MAX_BYTES_PER_FILE) > MAX_TOTAL_BYTES)
+            return;
+        let buf;
+        try {
+            const handle = fs.openSync(abs, "r");
+            try {
+                buf = Buffer.alloc(Math.min(size, MAX_BYTES_PER_FILE));
+                fs.readSync(handle, buf, 0, buf.length, 0);
+            }
+            finally {
+                fs.closeSync(handle);
+            }
+        }
+        catch {
+            return;
+        }
+        bytesInspected += buf.length;
+        const text = buf.toString("utf8");
+        for (const matcher of TEXT_PATTERNS) {
+            const match = matcher.regex.exec(text);
+            if (!match)
+                continue;
+            findings.push({
+                category: matcher.category,
+                severity: matcher.severity,
+                path: rel,
+                message: matcher.message,
+                excerpt: shortExcerpt(match[0]),
+            });
+        }
+    }, { maxFiles: MAX_FILES });
+    let riskClass = classify(findings);
+    if (input.requireSkillAcknowledgement &&
+        riskClass === "safe" &&
+        findings.length === 0) {
+        // Skill imports always require an explicit operator ack — surface a
+        // neutral "info" finding so the plan flags confirmation.
+        findings.push({
+            category: "shell-script",
+            severity: "info",
+            path: ".",
+            message: "Skill imports always require operator acknowledgement before the payload is wrapped into a workspace.",
+        });
+        riskClass = "caution";
+    }
+    return {
+        inspectedAt: new Date().toISOString(),
+        filesInspected,
+        bytesInspected,
+        findings,
+        riskClass,
+        blocked: findings.some((f) => f.severity === "blocking"),
+        summaryLines: summarise(findings, riskClass),
+    };
+}
+//# sourceMappingURL=security.js.map

package/dist/starter/source-import/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/starter/source-import/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,UAAU;AACjD,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,SAAS;AAEnD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,KAAK,EAAE,MAAM,EAAE,WAAW;IAC1B,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;IACzC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACvD,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IAC1D,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;IACzE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO;IAClD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAC/C,OAAO,EAAE,YAAY,EAAE,gBAAgB;IACvC,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ;IAC/B,MAAM,EAAE,MAAM,EAAE,MAAM;IACtB,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;CACf,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;CACvE,CAAC,CAAC;AAaH,MAAM,aAAa,GAAqB;IACtC;QACE,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,0DAA0D;QACjE,OAAO,EAAE,yDAAyD;KACnE;IACD;QACE,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,0DAA0D;QACjE,OAAO,EAAE,0DAA0D;KACpE;IACD;QACE,QAAQ,EAAE,wBAAwB;QAClC,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,4CAA4C;QACnD,OAAO,EAAE,8CAA8C;KACxD;IACD;QACE,QAAQ,EAAE,wBAAwB;QAClC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,0BAA0B;QACjC,OAAO,EAAE,qDAAqD;KAC/D;IACD;QACE,QAAQ,EAAE,wBAAwB;QAClC,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,wDAAwD;KAClE;IACD;QACE,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,wBAAwB;QAC/B,OAAO,EAAE,sCAAsC;KAChD;IACD;QACE,QAAQ,EAAE,qBAAqB;QAC/B,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,qEAAqE;QAC5E,OAAO,EAAE,2CAA2C;KACrD;IACD;QACE,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,gDAAgD;QACvD,OAAO,EAAE,uEAAuE;KACjF;IACD;QACE,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,oFAAoF;QAC3F,OAAO,EAAE,+EAA+E;KACzF;IACD;QACE,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,uEAAuE;QAC9E,OAAO,EAAE,8DAA8D;KACxE;IACD;QACE,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,wDAAwD;QAC/D,OAAO,EAAE,0EAA0E;KACpF;IACD;QACE,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,+DAA+D;QACtE,OAAO,EAAE,kCAAkC;KAC5C;IACD;QACE,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE,sCAAsC;KAChD;CACF,CAAC;AAEF,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IAC/C,OAAO,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,OAAO,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC;AACzE,CAAC;AAED,SAAS,QAAQ,CAAC,QAA2B;IAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IACzE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,GAAgC;IACpD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;QACtB,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;QACzB,KAAK,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3B,KAAK,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,QAA2B,EAAE,SAA0B;IACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,SAAS,SAAS,kCAAkC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,GAAa,CAAC,SAAS,SAAS,KAAK,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CACnD,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CACxB,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC;SACtB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;SACnE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAClB,IAAY,EACZ,MAAkD,EAClD,MAA4B;IAE5B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,OAAO,IAAI,MAAM,CAAC,QAAQ;YAAE,MAAM;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,MAAM;QACpB,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9C,iEAAiE;YACjE,uDAAuD;YACvD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;oBAAE,SAAS;gBACrE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACrC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,IAAI,MAAM,CAAC,QAAQ;gBAAE,MAAM;QACxC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAkBD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAgC;IAEhC,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,yCAAyC,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,MAAM,cAAc,GAAG,WAAW,CAChC,WAAW,EACX,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACX,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,mBAAmB;gBAC7B,QAAQ,EAAE,WAAW;gBACrB,IAAI,EAAE,GAAG;gBACT,OAAO,EAAE,uCAAuC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC;aACpG,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,oBAAoB;gBAC9B,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,GAAG;gBACT,OAAO,EAAE,6BAA6B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,4CAA4C;aACpG,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,OAAO;QACnC,IAAI,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,GAAG,eAAe;YAAE,OAAO;QAElF,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBACvD,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC7C,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,cAAc,IAAI,GAAG,CAAC,MAAM,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAElC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI,EAAE,GAAG;gBACT,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EACD,EAAE,QAAQ,EAAE,SAAS,EAAE,CACxB,CAAC;IAEF,IAAI,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnC,IACE,KAAK,CAAC,2BAA2B;QACjC,SAAS,KAAK,MAAM;QACpB,QAAQ,CAAC,MAAM,KAAK,CAAC,EACrB,CAAC;QACD,oEAAoE;QACpE,yDAAyD;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,GAAG;YACT,OAAO,EACL,uGAAuG;SAC1G,CAAC,CAAC;QACH,SAAS,GAAG,SAAS,CAAC;IACxB,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,cAAc;QACd,cAAc;QACd,QAAQ;QACR,SAAS;QACT,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QACxD,YAAY,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC;KAC7C,CAAC;AACJ,CAAC"}

package/dist/starter/source-import/skills-source.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Source Import Agent — skills.sh source adapter.
+ *
+ * The live skills.sh surface is HTML-first. This adapter therefore treats the
+ * public leaderboard pages and per-skill detail pages as the canonical source
+ * of truth for discovery and metadata, then resolves the selected skill back
+ * to its backing repository for payload materialization.
+ */
+import type { SkillsBrowseQuery, SkillsBrowseResult, SkillsSkillAccessProbe, SkillsSkillSourceInput } from "./types.js";
+export interface ParsedSkillRef {
+    /** Canonical skill id, typically "<owner>/<repo>/<skill>". */
+    skillId: string;
+    /** Optional version suffix parsed from "@version". */
+    version?: string;
+}
+export declare function parseSkillRef(raw: string): ParsedSkillRef;
+export declare function browseSkills(query?: SkillsBrowseQuery): Promise<SkillsBrowseResult>;
+export declare function probeSkillsSource(input: SkillsSkillSourceInput): Promise<SkillsSkillAccessProbe>;
+export interface FetchSkillPayloadInput {
+    probe: SkillsSkillAccessProbe;
+    destination: string;
+}
+export interface FetchSkillPayloadResult {
+    destination: string;
+    fileCount: number;
+}
+export declare function fetchSkillPayload(input: FetchSkillPayloadInput): Promise<FetchSkillPayloadResult>;
+//# sourceMappingURL=skills-source.d.ts.map

package/dist/starter/source-import/skills-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-source.d.ts","sourceRoot":"","sources":["../../../src/starter/source-import/skills-source.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAGV,iBAAiB,EACjB,kBAAkB,EAElB,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAqEpB,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CA4BzD;AA+ED,wBAAsB,YAAY,CAChC,KAAK,GAAE,iBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAmB7B;AA8GD,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,sBAAsB,CAAC,CAgDjC;AAMD,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAwFD,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CAqClC"}