@kitman-sh/cli 0.7.1 → 0.7.3

package/dist/{chunk-23ch5vdv.js → chunk-c5nwtn11.js}

@@ -10,7 +10,7 @@ import {
   RunnerHeaders,
   RunnerRpcProtocolVersion,
   RunnerRpcs
-} from "./chunk-5rp5hvc0.js";
+} from "./chunk-8g2twwm8.js";
 import {
   WebSocketConstructor,
   layerWebSocketConstructorGlobal,
@@ -19,7 +19,7 @@ import {
   make5,
   withHeaders,
   layerProtocolSocket
-} from "./chunk-9bje6bm0.js";
+} from "./chunk-84t0s0s2.js";
 
 // packages/live/src/rpc/runner-client.ts
 var proxiedWebSocket = (proxy) => succeed4(WebSocketConstructor)((target) => {

package/dist/{chunk-f1f60hgt.js → chunk-kt08et8q.js}

@@ -107,7 +107,7 @@ import {
   interrupt3,
   makeUnsafe3,
   makeUnsafe4,
-  make10,
+  make9,
   map4,
   filter,
   decodeText,
@@ -116,7 +116,7 @@ import {
   FileSystem,
   Path,
   ChildProcessSpawner,
-  make12,
+  make11,
   Crypto,
   value,
   is,
@@ -161,7 +161,7 @@ import {
   herdrRunnerCapabilitiesForRepoBinding2,
   herdrRunnerCapabilities2,
   assertHerdrRunnerCapability2
-} from "./chunk-5rp5hvc0.js";
+} from "./chunk-8g2twwm8.js";
 import {
   make4,
   readerString,
@@ -172,17 +172,17 @@ import {
   SocketUpgradeError,
   SocketCloseError,
   SocketError
-} from "./chunk-9bje6bm0.js";
-import"./chunk-tkk2synn.js";
+} from "./chunk-84t0s0s2.js";
+import"./chunk-0296rete.js";
 import {
   programLease,
   programHostsEnv,
   undeclaredHostsEnv
-} from "./chunk-2vcae278.js";
-import"./chunk-23ch5vdv.js";
+} from "./chunk-1n61xbaq.js";
+import"./chunk-c5nwtn11.js";
 import {
   nextInt
-} from "./chunk-1d2e4je3.js";
+} from "./chunk-x6j2j12j.js";
 
 // packages/core/src/runner-trust.ts
 import { createHash } from "crypto";
@@ -195,6 +195,129 @@ function sha256(value) {
   return createHash("sha256").update(value, "utf8").digest("hex");
 }
 
+// packages/core/src/engineering-resources.ts
+var marketplace = {
+  source: "kitman-engineering-loop",
+  publisher: "Kitman Platform",
+  visibility: "public",
+  trusted: true,
+  reviewStatus: "approved",
+  installable: true,
+  rollout: { channel: "default", installDefault: true, preservesExistingInstallations: true }
+};
+var kit = (input) => ({
+  ...input,
+  metadata: { marketplace }
+});
+var MattPocockProcessKit = kit({
+  name: "Matt Pocock Process",
+  slug: "matt-pocock-process",
+  kind: "process",
+  description: "Adversarial, type-safe implementation and review practice for Kitman Engineering.",
+  contentMarkdown: [
+    "# Matt Pocock Process",
+    "",
+    "Use fresh-context review, TDD, Effect-native boundaries, and explicit type contracts.",
+    "",
+    "## Complete skill collection",
+    "",
+    "diagnosing-bugs, tdd, effect-ts, codebase-design, api-and-interface-design, improve-codebase-architecture, doubt-driven-development, documentation-and-adrs, postgres-drizzle, security-and-hardening, source-driven-development, test-driven-development, research."
+  ].join(`
+`),
+  agentEnvironment: {
+    skills: [
+      {
+        name: "research",
+        policy: "required",
+        source: {
+          kind: "git",
+          url: "https://github.com/mattpocock/skills.git",
+          ref: "49dd158d1076134a641b33efb035946536778336",
+          path: "skills/engineering/research"
+        }
+      }
+    ]
+  },
+  agentInstructions: "Prefer the smallest correct change, preserve evidence, and stop on ambiguous public-interface decisions.",
+  doNotDo: "Do not execute user-controlled code in the API or Workflow worker."
+});
+var AddyOsmaniProcessKit = kit({
+  name: "Addy Osmani Process",
+  slug: "addy-osmani-process",
+  kind: "process",
+  description: "Incremental, accessible, observable, and production-focused delivery practice for Kitman Engineering.",
+  contentMarkdown: [
+    "# Addy Osmani Process",
+    "",
+    "Use incremental implementation, browser evidence, accessibility checks, CI discipline, and simplification.",
+    "",
+    "## Complete skill collection",
+    "",
+    "incremental-implementation, frontend-ui-engineering, browser-testing-with-devtools, web-design-guidelines, ci-cd-and-automation, code-review-and-quality, code-simplification, observability-and-instrumentation, performance-optimization, shipping-and-launch, git-workflow-and-versioning."
+  ].join(`
+`),
+  agentInstructions: "Prefer verifiable slices, accessible interfaces, and evidence that survives handoff.",
+  doNotDo: "Do not hide failures behind broad fallbacks or claim production evidence from local fixtures."
+});
+var PonytailProcessKit = kit({
+  name: "Ponytail",
+  slug: "ponytail",
+  kind: "process",
+  description: "Removes unnecessary code and complexity before implementation and review complete.",
+  contentMarkdown: `# Ponytail
+
+Prefer deletion, existing code, and the smallest correct change. Avoid speculative abstractions.`,
+  agentEnvironment: {
+    plugins: [
+      {
+        name: "ponytail",
+        policy: "required",
+        source: {
+          kind: "package",
+          packageName: "@dietrichgebert/ponytail",
+          version: "4.9.0"
+        }
+      }
+    ]
+  },
+  agentInstructions: "Use the required Ponytail skill before completing implementation or review.",
+  doNotDo: "Do not add an abstraction, dependency, or configuration without a present requirement."
+});
+var EngineeringTechnologyKitCatalog = [
+  kit({
+    name: "Backend",
+    slug: "backend",
+    kind: "technology",
+    description: "Effect, Elysia, PostgreSQL, Drizzle, Better Auth, and backend practices.",
+    contentMarkdown: `# Backend
+
+Effect, Elysia, PostgreSQL, Drizzle, Better Auth, API contracts, security, and observability.`
+  }),
+  kit({
+    name: "Frontend",
+    slug: "frontend",
+    kind: "technology",
+    description: "Nuxt, Vue, Nuxt UI, TanStack Query, VueUse, accessibility, and browser testing.",
+    contentMarkdown: `# Frontend
+
+Nuxt, Vue, Nuxt UI, TanStack Query, VueUse, accessibility, responsive UI, and browser testing.`
+  }),
+  kit({
+    name: "DevOps",
+    slug: "devops",
+    kind: "technology",
+    description: "Kubernetes, Kustomize, GitLab CI, and multi-stage container builds.",
+    contentMarkdown: `# DevOps
+
+Kubernetes, Kustomize, GitLab CI, multi-stage container builds, and operational verification.`
+  })
+];
+var EngineeringProcessKitCatalog = [
+  MattPocockProcessKit,
+  AddyOsmaniProcessKit,
+  PonytailProcessKit
+];
+
 // packages/agent-runtime/src/agent-environment.ts
 class AgentEnvironmentResolutionError extends TaggedError("AgentEnvironmentResolutionError") {
   get message() {
@@ -1596,6 +1719,9 @@ function repositoryUrl(repoBinding) {
   return repoBinding.repositoryUrl ?? `https://${repoBinding.host}/${repoBinding.owner}/${repoBinding.name}.git`;
 }
 // packages/agent-runtime/src/skill-materializer.ts
+var gitSourceKey = (source) => `${source.url}#${source.ref}:${source.path ?? ""}`;
+var reviewedGitSkillSources = new Set([...EngineeringProcessKitCatalog, ...EngineeringTechnologyKitCatalog].flatMap((kit) => kit.agentEnvironment?.skills ?? []).flatMap((skill) => skill.source.kind === "git" ? [gitSourceKey(skill.source)] : []));
+
 class AgentEnvironmentMaterializationError extends TaggedError("AgentEnvironmentMaterializationError") {
   get message() {
     return `AgentEnvironment materialization failed: ${this.issues.map((issue) => issue.message).join("; ")}`;
@@ -1616,35 +1742,50 @@ var previewAgentEnvironmentMaterialization = fnUntraced(function* (input) {
   for (const skill of input.environment.skills) {
     const skillKey = skillIdentity(skill.item);
     const source = skill.item.source;
-    const skip = (message) => {
-      const issue = { message, skillName: skill.item.name, skillKey };
+    const fromKit = skill.source.label === undefined ? "" : ` (from Kit ${skill.source.label})`;
+    const problem = source.kind === "kitman" ? source.contentMarkdown === undefined ? `Kitman skill ${skill.item.name} has no contentMarkdown to materialize.` : undefined : input.noInstall === true ? `Skipping materialization for ${skill.item.name} because sync was run with noInstall.` : source.kind !== "git" ? `Skill ${skill.item.name}${fromKit} comes from ${source.kind}, which Kitman cannot install yet; only Kitman and git skills are installed. Remove it from the Kit or make it recommended.` : !source.url.startsWith("https://") ? `Git skill ${skill.item.name} must come from an https URL, not ${source.url}.` : !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(source.ref) ? `Git skill ${skill.item.name} must be pinned to a commit, not ${source.ref}, so Kitman installs only the reviewed version.` : !reviewedGitSkillSources.has(gitSourceKey(source)) && !(input.approvedSkillSources ?? []).includes(gitSourceKey(source)) ? `Git skill ${skill.item.name}${fromKit} at ${gitSourceKey(source)} is not one Kitman reviewed; approve it by adding that source to approvedSkillSources in your Kitman user config, or remove it from the Kit.` : undefined;
+    if (problem !== undefined) {
+      const issue = { message: problem, skillName: skill.item.name, skillKey };
       if (skill.item.policy === "required")
-        return new AgentEnvironmentMaterializationError({ issues: [issue] });
+        return yield* new AgentEnvironmentMaterializationError({ issues: [issue] });
       warnings.push(issue);
-      return;
-    };
-    const refusal = source.kind !== "kitman" ? skip(input.noInstall === true ? `Skipping materialization for ${skill.item.name} because sync was run with noInstall.` : `Materializing ${skill.item.name} from ${source.kind} is not supported; only Kitman skills are materialized.`) : source.contentMarkdown === undefined ? skip(`Kitman skill ${skill.item.name} has no contentMarkdown to materialize.`) : undefined;
-    if (refusal !== undefined)
-      return yield* refusal;
-    if (source.kind !== "kitman" || source.contentMarkdown === undefined)
       continue;
-    const skillPath = path.join(sourceRoot, "kitman", hashSegment(source.skillId ?? source.name ?? skill.item.name), skillSlug2(skill.item.name));
-    operations.push({
-      kind: "write_skill",
-      skillName: skill.item.name,
-      skillKey,
-      path: path.join(skillPath, "SKILL.md"),
-      content: skillMarkdown(skill.item.name, source.contentMarkdown)
-    }, {
-      kind: "symlink_skill",
-      skillName: skill.item.name,
-      skillKey,
-      sourcePath: skillPath,
-      targetPath: path.join(targetRoot, `${skillSlug2(skill.item.name)}-${hashSegment(skillKey)}`),
-      sourceRoot,
-      targetRoot
-    });
-    materializedSkills.push({ name: skill.item.name, key: skillKey, harness, source, skillPath, managed: true });
+    }
+    const expose = (skillPath) => {
+      operations.push({
+        kind: "symlink_skill",
+        skillName: skill.item.name,
+        skillKey,
+        sourcePath: skillPath,
+        targetPath: path.join(targetRoot, `${skillSlug2(skill.item.name)}-${hashSegment(skillKey)}`),
+        sourceRoot,
+        targetRoot
+      });
+      materializedSkills.push({ name: skill.item.name, key: skillKey, harness, source, skillPath, managed: true });
+    };
+    if (source.kind === "git") {
+      const skillPath = path.join(sourceRoot, "git", hashSegment(skillKey), skillSlug2(skill.item.name));
+      operations.push({
+        kind: "fetch_git_skill",
+        skillName: skill.item.name,
+        skillKey,
+        url: source.url,
+        ref: source.ref,
+        ...source.path === undefined ? undefined : { repositoryPath: source.path },
+        path: skillPath
+      });
+      expose(skillPath);
+    } else if (source.kind === "kitman" && source.contentMarkdown !== undefined) {
+      const skillPath = path.join(sourceRoot, "kitman", hashSegment(source.skillId ?? source.name ?? skill.item.name), skillSlug2(skill.item.name));
+      operations.push({
+        kind: "write_skill",
+        skillName: skill.item.name,
+        skillKey,
+        path: path.join(skillPath, "SKILL.md"),
+        content: skillMarkdown(skill.item.name, source.contentMarkdown)
+      });
+      expose(skillPath);
+    }
   }
   return { harness, operations, materializedSkills, warnings };
 });
@@ -1652,28 +1793,74 @@ var applyAgentEnvironmentMaterialization = fnUntraced(function* (plan) {
   for (const operation of plan.operations) {
     if (operation.kind === "write_skill")
       yield* writeSkill(plan, operation);
+    else if (operation.kind === "fetch_git_skill")
+      yield* fetchGitSkill(plan, operation);
     else
       yield* exposeSkill(operation);
   }
   return plan;
 });
 var refuse = (message) => fail4(new SkillMaterializationRefused({ message }));
-var writeSkill = (plan, operation) => gen(function* () {
-  const fs = yield* FileSystem;
+var managedSkillPath = (plan, skillKey, file) => gen(function* () {
   const path = yield* Path;
-  const boundary = plan.operations.find((candidate) => candidate.kind === "symlink_skill" && candidate.skillKey === operation.skillKey);
+  const boundary = plan.operations.find((candidate) => candidate.kind === "symlink_skill" && candidate.skillKey === skillKey);
   if (boundary === undefined)
     return yield* refuse("SKILL_SYMLINK_BOUNDARY_MISSING");
   const root = path.resolve(boundary.sourceRoot);
-  const target = path.resolve(operation.path);
+  const target = path.resolve(file);
   if (!isPathWithin(path, root, target) || target === root)
     return yield* refuse("SKILL_WRITE_OUTSIDE_ROOT");
   yield* assertNoSymlinkComponents(path.dirname(target), "SKILL_WRITE_OUTSIDE_ROOT");
+  return target;
+});
+var writeSkill = (plan, operation) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const target = yield* managedSkillPath(plan, operation.skillKey, operation.path);
   if (yield* isSymbolicLink(target))
     return yield* refuse("SKILL_WRITE_SYMLINK");
   yield* fs.makeDirectory(path.dirname(target), { recursive: true });
   yield* fs.writeFileString(target, operation.content);
 });
+var fetchGitSkill = (plan, operation) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const target = yield* managedSkillPath(plan, operation.skillKey, operation.path);
+  const scratch = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-git-skill-" });
+  const repository = path.join(scratch, "repository");
+  const tree = path.join(scratch, "tree");
+  const git = (...args) => runCommand2("git", ["--git-dir", repository, ...args]);
+  yield* fs.makeDirectory(tree);
+  yield* runCommand2("git", ["init", "--quiet", "--bare", repository]);
+  yield* git("fetch", "--quiet", "--depth", "1", "--", operation.url, operation.ref);
+  yield* git("--work-tree", tree, "checkout", "FETCH_HEAD", "--", ".");
+  const skillDirectory = path.resolve(tree, operation.repositoryPath ?? ".");
+  if (!isPathWithin(path, tree, skillDirectory))
+    return yield* refuse("SKILL_SOURCE_OUTSIDE_ROOT");
+  if (yield* containsSymbolicLink(tree, skillDirectory))
+    return yield* refuse(`Git skill ${operation.skillName} links to a file outside itself in ${operation.url}@${operation.ref}; Kitman does not install linked files.`);
+  if (!(yield* fs.exists(path.join(skillDirectory, "SKILL.md"))))
+    return yield* refuse(`Git skill ${operation.skillName} has no SKILL.md at ${operation.repositoryPath ?? "the repository root"} in ${operation.url}@${operation.ref}.`);
+  const staged = `${target}.partial`;
+  yield* fs.remove(staged, { recursive: true, force: true });
+  yield* fs.makeDirectory(path.dirname(target), { recursive: true });
+  yield* fs.copy(skillDirectory, staged);
+  yield* fs.remove(target, { recursive: true, force: true });
+  yield* fs.rename(staged, target);
+}).pipe(scoped);
+var containsSymbolicLink = (root, directory) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  for (let current = directory;current !== root; current = path.dirname(current))
+    if (yield* isSymbolicLink(current))
+      return true;
+  if (!(yield* fs.exists(directory)))
+    return false;
+  for (const entry of yield* fs.readDirectory(directory, { recursive: true }))
+    if (yield* isSymbolicLink(path.join(directory, entry)))
+      return true;
+  return false;
+});
 var exposeSkill = (operation) => gen(function* () {
   const fs = yield* FileSystem;
   const path = yield* Path;
@@ -2494,7 +2681,7 @@ var temporaryDirectory = map3(optionalEnv("TMPDIR"), (tmp) => tmp ?? "/tmp");
 var spawnServer = (input) => gen(function* () {
   const spawner = yield* ChildProcessSpawner;
   const scope = yield* make6();
-  const handle = yield* spawner.spawn(make12(input.command, [...input.args], {
+  const handle = yield* spawner.spawn(make11(input.command, [...input.args], {
     env: { HERDR_SOCKET_PATH: input.socketPath },
     extendEnv: true,
     detached: true,
@@ -4368,7 +4555,8 @@ var previewAgentEnvironmentPlan = fnUntraced(function* (input) {
     ...input.rootDir === undefined ? undefined : { rootDir: input.rootDir },
     ...input.scope === undefined ? undefined : { scope: input.scope },
     ...input.cacheRoot === undefined ? undefined : { cacheRoot: input.cacheRoot },
-    ...input.noInstall === undefined ? undefined : { noInstall: input.noInstall }
+    ...input.noInstall === undefined ? undefined : { noInstall: input.noInstall },
+    ...input.approvedSkillSources === undefined ? undefined : { approvedSkillSources: input.approvedSkillSources }
   });
   const harnessConfig = yield* previewAgentEnvironmentConfigSync({
     environment: input.environment,
@@ -4451,10 +4639,10 @@ var handshake = [
 `).join("");
 var kitmanMcpPreflight = (mcp) => gen(function* () {
   const spawner = yield* ChildProcessSpawner;
-  const server = yield* spawner.spawn(make12(mcp.command, [...mcp.args], {
+  const server = yield* spawner.spawn(make11(mcp.command, [...mcp.args], {
     extendEnv: true,
     env: mcp.env,
-    stdin: { stream: make10(new TextEncoder().encode(handshake)), endOnDone: false },
+    stdin: { stream: make9(new TextEncoder().encode(handshake)), endOnDone: false },
     stderr: "ignore"
   }));
   const reply = yield* server.stdout.pipe(decodeText, splitLines, map4((line) => recordValue(getOrUndefined(decodeJsonStringOption(line)))), filter((message) => message?.id === 2), runHead);
@@ -4526,8 +4714,8 @@ var programProcessExecutor = (input) => (work) => gen(function* () {
   };
   const exitCode = sandbox === undefined ? yield* gen(function* () {
     const spawner = yield* ChildProcessSpawner;
-    const handle = yield* spawner.spawn(make12(input.bun ?? process.execPath, [file], {
-      stdin: make10(new TextEncoder().encode(stdin)),
+    const handle = yield* spawner.spawn(make11(input.bun ?? process.execPath, [file], {
+      stdin: make9(new TextEncoder().encode(stdin)),
       stdout: "inherit",
       stderr: "inherit",
       extendEnv: false,