@growthub/cli 0.6.5 → 0.6.7

package/dist/starter/source-import/security.js

@@ -1,323 +0,0 @@
-/**
- * Source Import Agent — shared security inspector.
- *
- * Deterministic, bounded, read-only static analysis over a materialised
- * source payload (cloned repo or unpacked skill). The inspector NEVER
- * executes any script. It emits a `SourceSecurityReport` that:
- *
- *   - lists pattern-based findings (shell scripts, install hooks,
- *     external downloads, prompt-injection patterns, env mutation,
- *     privileged instructions, suspicious archives)
- *   - aggregates a risk class (`safe` | `caution` | `high-risk` | `blocked`)
- *   - produces short operator-facing summary lines rendered in the
- *     confirmation prompt
- *
- * Two risk surfaces the caller uses downstream:
- *
- *   - `report.blocked` → agent MUST refuse to continue even on confirm.
- *   - `report.riskClass !== "safe"` → plan flags the inspect action as
- *     needing explicit confirmation.
- *
- * Skills imports ALWAYS require the inspection + confirmation, even when
- * the report is "safe", because skills are agent primitives closer to
- * executable content than generic repos.
- */
-import fs from "node:fs";
-import path from "node:path";
-// ---------------------------------------------------------------------------
-// Bounds — keep the inspector deterministic and cheap
-// ---------------------------------------------------------------------------
-const MAX_FILES = 2000;
-const MAX_BYTES_PER_FILE = 256 * 1024; // 256 KiB
-const MAX_TOTAL_BYTES = 16 * 1024 * 1024; // 16 MiB
-const TEXT_EXTENSIONS = new Set([
-    ".md", ".mdx", ".markdown",
-    ".txt", ".json", ".yaml", ".yml", ".toml",
-    ".sh", ".bash", ".zsh", ".fish", ".ps1", ".bat", ".cmd",
-    ".py", ".rb", ".js", ".cjs", ".mjs", ".ts", ".tsx", ".jsx",
-    ".go", ".rs", ".java", ".kt", ".swift", ".c", ".cc", ".cpp", ".h", ".hpp",
-    ".html", ".htm", ".css", ".scss", ".sass", ".less",
-    ".xml", ".csv", ".ini", ".env", ".conf", ".cfg",
-    ".lock", ".gitignore", ".gitattributes",
-    ".dockerfile",
-]);
-const SUSPICIOUS_BINARY_EXTENSIONS = new Set([
-    ".exe", ".dll", ".so", ".dylib",
-    ".bin", ".app", ".msi",
-    ".apk", ".ipa",
-    ".jar", ".war",
-    ".dmg", ".pkg",
-]);
-const ARCHIVE_EXTENSIONS = new Set([
-    ".zip", ".tar", ".tgz", ".tar.gz", ".bz2", ".xz", ".7z", ".rar", ".gz",
-]);
-const TEXT_PATTERNS = [
-    {
-        category: "external-download",
-        severity: "high-risk",
-        regex: /\bcurl\s+[^|\n]*\|\s*(sudo\s+)?(sh|bash|zsh|ksh|fish)\b/i,
-        message: "Pipes remote content directly into a shell interpreter.",
-    },
-    {
-        category: "external-download",
-        severity: "high-risk",
-        regex: /\bwget\s+[^|\n]*\|\s*(sudo\s+)?(sh|bash|zsh|ksh|fish)\b/i,
-        message: "Pipes a wget download directly into a shell interpreter.",
-    },
-    {
-        category: "privileged-instruction",
-        severity: "high-risk",
-        regex: /\bsudo\s+rm\s+-rf?\s+\/(?!home|Users|tmp)/i,
-        message: "Invokes sudo rm -rf on a root-adjacent path.",
-    },
-    {
-        category: "privileged-instruction",
-        severity: "blocking",
-        regex: /\brm\s+-rf\s+\/(?:\s|$)/i,
-        message: "Attempts to recursively delete the filesystem root.",
-    },
-    {
-        category: "privileged-instruction",
-        severity: "caution",
-        regex: /\bchmod\s+\+s\b/i,
-        message: "Sets the setuid/setgid bit — requires explicit review.",
-    },
-    {
-        category: "env-mutation",
-        severity: "caution",
-        regex: /\bexport\s+[A-Z_]+\s*=/,
-        message: "Mutates shell environment variables.",
-    },
-    {
-        category: "network-heavy-setup",
-        severity: "caution",
-        regex: /\bnpm\s+install\s+-g\b|\bpnpm\s+add\s+-g\b|\byarn\s+global\s+add\b/i,
-        message: "Installs a package globally during setup.",
-    },
-    {
-        category: "install-hook",
-        severity: "caution",
-        regex: /"(preinstall|postinstall|prepare|install)"\s*:/,
-        message: "Declares an npm lifecycle install hook that can run on `npm install`.",
-    },
-    {
-        category: "prompt-injection",
-        severity: "caution",
-        regex: /\b(ignore|disregard|forget)\s+(all\s+)?previous\s+(instructions|rules|prompts?)\b/i,
-        message: "Prompt-injection pattern — text asks the agent to discard prior instructions.",
-    },
-    {
-        category: "prompt-injection",
-        severity: "caution",
-        regex: /\byou\s+are\s+now\s+(an?|the)\s+[a-z\s]+\s+(assistant|agent|model)\b/i,
-        message: "Prompt-injection pattern — text attempts a persona override.",
-    },
-    {
-        category: "prompt-injection",
-        severity: "high-risk",
-        regex: /system\s*:\s*override\s+(safety|guardrails?|policies)/i,
-        message: "Prompt-injection pattern — instructs the agent to override safety rules.",
-    },
-    {
-        category: "shell-script",
-        severity: "info",
-        regex: /^#!\s*\/(?:usr\/)?bin\/(?:env\s+)?(?:sh|bash|zsh|ksh|fish)\b/m,
-        message: "Executable shell script shebang.",
-    },
-    {
-        category: "external-download",
-        severity: "caution",
-        regex: /\bnpx\s+[^\s]+/i,
-        message: "Invokes npx on an arbitrary package.",
-    },
-];
-// ---------------------------------------------------------------------------
-// Traversal
-// ---------------------------------------------------------------------------
-function isLikelyTextFile(filename) {
-    const ext = path.extname(filename).toLowerCase();
-    if (!ext)
-        return true; // README, LICENSE, etc.
-    return TEXT_EXTENSIONS.has(ext);
-}
-function isSuspiciousBinary(filename) {
-    return SUSPICIOUS_BINARY_EXTENSIONS.has(path.extname(filename).toLowerCase());
-}
-function isUnexpectedArchive(filename) {
-    const ext = path.extname(filename).toLowerCase();
-    return ARCHIVE_EXTENSIONS.has(ext) || filename.toLowerCase().endsWith(".tar.gz");
-}
-function shortExcerpt(line) {
-    const trimmed = line.trim();
-    return trimmed.length <= 120 ? trimmed : `${trimmed.slice(0, 117)}...`;
-}
-function classify(findings) {
-    if (findings.some((f) => f.severity === "blocking"))
-        return "blocked";
-    if (findings.some((f) => f.severity === "high-risk"))
-        return "high-risk";
-    if (findings.some((f) => f.severity === "caution"))
-        return "caution";
-    return "safe";
-}
-function severityRank(sev) {
-    switch (sev) {
-        case "info": return 0;
-        case "caution": return 1;
-        case "high-risk": return 2;
-        case "blocking": return 3;
-    }
-}
-function summarise(findings, riskClass) {
-    if (findings.length === 0) {
-        return [`Risk: ${riskClass}. No security findings surfaced.`];
-    }
-    const byCategory = new Map();
-    for (const f of findings) {
-        byCategory.set(f.category, (byCategory.get(f.category) ?? 0) + 1);
-    }
-    const lines = [`Risk: ${riskClass}. ${findings.length} finding(s).`];
-    const ordered = Array.from(byCategory.entries()).sort(([, a], [, b]) => b - a);
-    for (const [cat, count] of ordered) {
-        lines.push(`  • ${cat}: ${count}`);
-    }
-    const top = [...findings]
-        .sort((a, b) => severityRank(b.severity) - severityRank(a.severity))
-        .slice(0, 3);
-    for (const f of top) {
-        lines.push(`  [${f.severity}] ${f.path} — ${f.message}`);
-    }
-    return lines;
-}
-function walkPayload(root, onFile, limits) {
-    let visited = 0;
-    const stack = [root];
-    while (stack.length > 0) {
-        if (visited >= limits.maxFiles)
-            break;
-        const current = stack.pop();
-        if (!current)
-            break;
-        let entries;
-        try {
-            entries = fs.readdirSync(current, { withFileTypes: true });
-        }
-        catch {
-            continue;
-        }
-        for (const entry of entries) {
-            const abs = path.resolve(current, entry.name);
-            // Skip .git and node_modules trees entirely — they are noise for
-            // the operator review and bloat the inspection budget.
-            if (entry.isDirectory()) {
-                if (entry.name === ".git" || entry.name === "node_modules")
-                    continue;
-                stack.push(abs);
-                continue;
-            }
-            if (!entry.isFile())
-                continue;
-            const rel = path.relative(root, abs);
-            onFile(abs, rel);
-            visited += 1;
-            if (visited >= limits.maxFiles)
-                break;
-        }
-    }
-    return visited;
-}
-/**
- * Inspect a materialised source payload and return a
- * `SourceSecurityReport`. Pure read-only.
- */
-export function inspectSourcePayload(input) {
-    const { payloadRoot } = input;
-    if (!fs.existsSync(payloadRoot) || !fs.statSync(payloadRoot).isDirectory()) {
-        throw new Error(`Inspection target is not a directory: ${payloadRoot}`);
-    }
-    const findings = [];
-    let bytesInspected = 0;
-    const filesInspected = walkPayload(payloadRoot, (abs, rel) => {
-        let size = 0;
-        try {
-            size = fs.statSync(abs).size;
-        }
-        catch {
-            return;
-        }
-        if (isSuspiciousBinary(rel)) {
-            findings.push({
-                category: "suspicious-binary",
-                severity: "high-risk",
-                path: rel,
-                message: `Payload ships a precompiled binary (${path.extname(rel)}). Review provenance before use.`,
-            });
-            return;
-        }
-        if (isUnexpectedArchive(rel)) {
-            findings.push({
-                category: "unexpected-archive",
-                severity: "caution",
-                path: rel,
-                message: `Payload ships an archive (${path.extname(rel)}) — expand and review contents before use.`,
-            });
-            return;
-        }
-        if (!isLikelyTextFile(rel))
-            return;
-        if (bytesInspected + Math.min(size, MAX_BYTES_PER_FILE) > MAX_TOTAL_BYTES)
-            return;
-        let buf;
-        try {
-            const handle = fs.openSync(abs, "r");
-            try {
-                buf = Buffer.alloc(Math.min(size, MAX_BYTES_PER_FILE));
-                fs.readSync(handle, buf, 0, buf.length, 0);
-            }
-            finally {
-                fs.closeSync(handle);
-            }
-        }
-        catch {
-            return;
-        }
-        bytesInspected += buf.length;
-        const text = buf.toString("utf8");
-        for (const matcher of TEXT_PATTERNS) {
-            const match = matcher.regex.exec(text);
-            if (!match)
-                continue;
-            findings.push({
-                category: matcher.category,
-                severity: matcher.severity,
-                path: rel,
-                message: matcher.message,
-                excerpt: shortExcerpt(match[0]),
-            });
-        }
-    }, { maxFiles: MAX_FILES });
-    let riskClass = classify(findings);
-    if (input.requireSkillAcknowledgement &&
-        riskClass === "safe" &&
-        findings.length === 0) {
-        // Skill imports always require an explicit operator ack — surface a
-        // neutral "info" finding so the plan flags confirmation.
-        findings.push({
-            category: "shell-script",
-            severity: "info",
-            path: ".",
-            message: "Skill imports always require operator acknowledgement before the payload is wrapped into a workspace.",
-        });
-        riskClass = "caution";
-    }
-    return {
-        inspectedAt: new Date().toISOString(),
-        filesInspected,
-        bytesInspected,
-        findings,
-        riskClass,
-        blocked: findings.some((f) => f.severity === "blocking"),
-        summaryLines: summarise(findings, riskClass),
-    };
-}
-//# sourceMappingURL=security.js.map

package/dist/starter/source-import/security.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/starter/source-import/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAQ7B,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,UAAU;AACjD,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,SAAS;AAEnD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,KAAK,EAAE,MAAM,EAAE,WAAW;IAC1B,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;IACzC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACvD,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM;IAC1D,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;IACzE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO;IAClD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IAC/C,OAAO,EAAE,YAAY,EAAE,gBAAgB;IACvC,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ;IAC/B,MAAM,EAAE,MAAM,EAAE,MAAM;IACtB,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;CACf,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;CACvE,CAAC,CAAC;AAaH,MAAM,aAAa,GAAqB;IACtC;QACE,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,0DAA0D;QACjE,OAAO,EAAE,yDAAyD;KACnE;IACD;QACE,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,0DAA0D;QACjE,OAAO,EAAE,0DAA0D;KACpE;IACD;QACE,QAAQ,EAAE,wBAAwB;QAClC,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,4CAA4C;QACnD,OAAO,EAAE,8CAA8C;KACxD;IACD;QACE,QAAQ,EAAE,wBAAwB;QAClC,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,0BAA0B;QACjC,OAAO,EAAE,qDAAqD;KAC/D;IACD;QACE,QAAQ,EAAE,wBAAwB;QAClC,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,wDAAwD;KAClE;IACD;QACE,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,wBAAwB;QAC/B,OAAO,EAAE,sCAAsC;KAChD;IACD;QACE,QAAQ,EAAE,qBAAqB;QAC/B,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,qEAAqE;QAC5E,OAAO,EAAE,2CAA2C;KACrD;IACD;QACE,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,gDAAgD;QACvD,OAAO,EAAE,uEAAuE;KACjF;IACD;QACE,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,oFAAoF;QAC3F,OAAO,EAAE,+EAA+E;KACzF;IACD;QACE,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,uEAAuE;QAC9E,OAAO,EAAE,8DAA8D;KACxE;IACD;QACE,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,WAAW;QACrB,KAAK,EAAE,wDAAwD;QAC/D,OAAO,EAAE,0EAA0E;KACpF;IACD;QACE,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,+DAA+D;QACtE,OAAO,EAAE,kCAAkC;KAC5C;IACD;QACE,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,SAAS;QACnB,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE,sCAAsC;KAChD;CACF,CAAC;AAEF,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IAC/C,OAAO,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,OAAO,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,OAAO,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC;AACzE,CAAC;AAED,SAAS,QAAQ,CAAC,QAA2B;IAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACtE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IACzE,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,GAAgC;IACpD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC;QACtB,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;QACzB,KAAK,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3B,KAAK,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,QAA2B,EAAE,SAA0B;IACxE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,SAAS,SAAS,kCAAkC,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,KAAK,GAAa,CAAC,SAAS,SAAS,KAAK,QAAQ,CAAC,MAAM,cAAc,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CACnD,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CACxB,CAAC;IACF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC;SACtB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;SACnE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAClB,IAAY,EACZ,MAAkD,EAClD,MAA4B;IAE5B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,OAAO,IAAI,MAAM,CAAC,QAAQ;YAAE,MAAM;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,MAAM;QACpB,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9C,iEAAiE;YACjE,uDAAuD;YACvD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;oBAAE,SAAS;gBACrE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACrC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,IAAI,MAAM,CAAC,QAAQ;gBAAE,MAAM;QACxC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAkBD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAgC;IAEhC,MAAM,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,yCAAyC,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,MAAM,cAAc,GAAG,WAAW,CAChC,WAAW,EACX,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACX,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,mBAAmB;gBAC7B,QAAQ,EAAE,WAAW;gBACrB,IAAI,EAAE,GAAG;gBACT,OAAO,EAAE,uCAAuC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC;aACpG,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,oBAAoB;gBAC9B,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,GAAG;gBACT,OAAO,EAAE,6BAA6B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,4CAA4C;aACpG,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,OAAO;QACnC,IAAI,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,GAAG,eAAe;YAAE,OAAO;QAElF,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrC,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBACvD,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC7C,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,cAAc,IAAI,GAAG,CAAC,MAAM,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAElC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI,EAAE,GAAG;gBACT,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,EACD,EAAE,QAAQ,EAAE,SAAS,EAAE,CACxB,CAAC;IAEF,IAAI,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnC,IACE,KAAK,CAAC,2BAA2B;QACjC,SAAS,KAAK,MAAM;QACpB,QAAQ,CAAC,MAAM,KAAK,CAAC,EACrB,CAAC;QACD,oEAAoE;QACpE,yDAAyD;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,GAAG;YACT,OAAO,EACL,uGAAuG;SAC1G,CAAC,CAAC;QACH,SAAS,GAAG,SAAS,CAAC;IACxB,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,cAAc;QACd,cAAc;QACd,QAAQ;QACR,SAAS;QACT,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;QACxD,YAAY,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC;KAC7C,CAAC;AACJ,CAAC"}

package/dist/starter/source-import/skills-source.d.ts

@@ -1,28 +0,0 @@
-/**
- * Source Import Agent — skills.sh source adapter.
- *
- * The live skills.sh surface is HTML-first. This adapter therefore treats the
- * public leaderboard pages and per-skill detail pages as the canonical source
- * of truth for discovery and metadata, then resolves the selected skill back
- * to its backing repository for payload materialization.
- */
-import type { SkillsBrowseQuery, SkillsBrowseResult, SkillsSkillAccessProbe, SkillsSkillSourceInput } from "./types.js";
-export interface ParsedSkillRef {
-    /** Canonical skill id, typically "<owner>/<repo>/<skill>". */
-    skillId: string;
-    /** Optional version suffix parsed from "@version". */
-    version?: string;
-}
-export declare function parseSkillRef(raw: string): ParsedSkillRef;
-export declare function browseSkills(query?: SkillsBrowseQuery): Promise<SkillsBrowseResult>;
-export declare function probeSkillsSource(input: SkillsSkillSourceInput): Promise<SkillsSkillAccessProbe>;
-export interface FetchSkillPayloadInput {
-    probe: SkillsSkillAccessProbe;
-    destination: string;
-}
-export interface FetchSkillPayloadResult {
-    destination: string;
-    fileCount: number;
-}
-export declare function fetchSkillPayload(input: FetchSkillPayloadInput): Promise<FetchSkillPayloadResult>;
-//# sourceMappingURL=skills-source.d.ts.map

package/dist/starter/source-import/skills-source.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"skills-source.d.ts","sourceRoot":"","sources":["../../../src/starter/source-import/skills-source.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,KAAK,EAGV,iBAAiB,EACjB,kBAAkB,EAElB,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAqEpB,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CA4BzD;AA+ED,wBAAsB,YAAY,CAChC,KAAK,GAAE,iBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAmB7B;AA8GD,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,sBAAsB,CAAC,CAgDjC;AAMD,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,sBAAsB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAwFD,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CAqClC"}