@kubbisec/ai-linux-arm64 0.1.8 → 0.1.10

package/bundled/skills/aspm-platform/SKILL.md

@@ -3,11 +3,58 @@ name: aspm-platform
 description: KubbiSec ASPM — uploads, gates, projetos e integração com NAUS/CLI.
 ---
 
-## Visão geral
+## Instalação
 
-- **CLI:** `npm install -g @kubbisec/aspm` → `aspm upload <ficheiro> -s <scanner> -p <project> …`
-- **Doc produto:** `aspm_docs` (17 páginas web + `docs/aspm/docker-cli` + getting-started).
-- **Findings:** `list_findings`, `get_finding_summary`, `kbs fix`, skill `remediation`.
+`npm install -g @kubbisec/aspm` → binário `aspm`.
+
+**Docs:** `aspm_docs` (secção `aspm-commands` + guias por scanner). **HARD-GATE:** chamar `aspm_docs` ou `security_scanner_playbook` antes de citar flags completas — não inventar sintaxe.
+
+## Comandos CLI
+
+| Comando | Quando usar |
+|---------|-------------|
+| `aspm init` | Setup rápido (interativo) |
+| `aspm login` | Configurar credenciais (interativo ou flags) |
+| `aspm whoami` | Mostrar configuração atual |
+| `aspm doctor` | Diagnosticar configuração |
+| `aspm scan <file> -s <source>` | Parse **local** de relatório (sem upload API) |
+| `aspm parse <file> -s <source>` | Parse local (dry run) |
+| `aspm upload <file> -s <source>` | **Upload** de relatório para a API |
+| `aspm coverage <file>` | Upload de coverage (lcov) |
+| `aspm parse-coverage <file>` | Parse coverage local |
+| `aspm projects` | Listar projetos da organização |
+| `aspm dashboard` | Abrir dashboard no browser |
+
+### Flags globais
+
+`-k/--api-key`, `-o/--org`, `-p/--project`, `-v/--version`, `-h/--help`
+
+### Variáveis de ambiente (precedência: flags CLI > env > `~/.kubbisec/config.json`)
+
+| Variável | Descrição |
+|----------|-----------|
+| `KUBBISEC_API_URL` / `ASPM_API_URL` | URL da API |
+| `KUBBISEC_API_KEY` / `ASPM_API_KEY` | API key |
+| `KUBBISEC_ORG_ID` / `ASPM_ORG_ID` | Organization ID |
+| `KUBBISEC_PROJECT` / `KUBBISEC_PROJECT_ID` / `ASPM_PROJECT_ID` | Project ID |
+
+## Scanners ↔ `-s` ↔ ficheiro de relatório
+
+| Scanner | `-s` | Ficheiro típico |
+|---------|------|-----------------|
+| Trivy | `trivy` | `trivy-report.json` |
+| Gitleaks | `gitleaks` | `gitleaks-report.json` |
+| Syft | `syft` | `sbom.json` |
+| OSV | `osv` | `osv-report.json` |
+| Semgrep | `semgrep` | `semgrep-report.json` |
+| Sonar | `sonar` | `sonar-report.json` |
+| Nmap | `nmap` | `nmap-report.xml` |
+| Skipfish | `skipfish` | `skipfish-report.json` |
+
+1. `security_scanners_catalog` — capacidades e formatos.
+2. `security_scanner_playbook(scanner, platform?, topic?)` — install, scan, upload, snippet NAUS.
+
+**Nota:** `aspm-cicd.md` descreve **GitHub Actions** (`jobs:`, `needs:`). Para CI nativo KubbiSec, usar skill `naus-pipelines` e `naus_pipeline_docs`.
 
 ## Remediação via tools (kbs chat)
 
@@ -16,26 +63,14 @@ description: KubbiSec ASPM — uploads, gates, projetos e integração com NAUS/
 3. `generate_remediation_plan` com o mesmo `vulnerabilityId`
 4. `start_ai_remediation_run` com `vulnerabilityId` e `mode: suggestion` (ou `auto` se permitido)
 
-Sem finding ativo na UI web, **sempre** passe `vulnerabilityId` nos args. O ID fica sticky na sessão após a primeira chamada.
+Sem finding ativo na UI web, **sempre** passe `vulnerabilityId` nos args.
 
 ## Remediar todas as vulnerabilidades por projeto
 
 1. `kubsec_list_projects` — listar projetos da org
 2. Para **cada** projeto: `list_findings({ projectId, severity?, limit: 50 })`
-3. Para **cada** item em `items[]` (por severidade, ex. HIGH primeiro):
-   - `generate_remediation_plan({ vulnerabilityId: item.id })`
-   - `start_ai_remediation_run({ vulnerabilityId: item.id, mode: "suggestion" })`
-   - Acompanhar com `get_ai_remediation_run_status` / logs se necessário
-4. Passar ao projeto seguinte
-
-Não existe tool batch — processe sequencialmente. Confirme scope no questionário (`questionnaire`) antes de mutations em massa.
-
-## Scanners suportados
-
-trivy, gitleaks, syft, osv, semgrep, sonar, nmap, skipfish.
-
-1. `security_scanners_catalog` — capacidades e ficheiros de relatório.
-2. `security_scanner_playbook(scanner, platform?, topic?)` — install, scan, upload, NAUS.
+3. Para **cada** item: `generate_remediation_plan` → `start_ai_remediation_run`
+4. Não existe tool batch — processe sequencialmente.
 
 ## Local (`kbs chat --extended-context`)
 
@@ -46,12 +81,7 @@ trivy, gitleaks, syft, osv, semgrep, sonar, nmap, skipfish.
 | `aspm_local_scan` | `aspm scan <file> -s <source>` |
 | `aspm_local_upload` | `aspm upload <file> -s <source> -p <projectId>` |
 
-## Env (precedência: flags CLI > env > `~/.kubbisec/config.json`)
-
-- `KUBBISEC_API_URL` / `ASPM_API_URL`
-- `KUBBISEC_API_KEY` / `ASPM_API_KEY`
-- `KUBBISEC_ORG_ID` / `ASPM_ORG_ID`
-- `KUBBISEC_PROJECT` / `KUBBISEC_PROJECT_ID` / `ASPM_PROJECT_ID`
+`parse`, `parse-coverage`, `coverage`, `projects`, `dashboard` — usar CLI diretamente no terminal; documentar via `aspm_docs`.
 
 ## NAUS
 

package/bundled/skills/at-path-mentions.d.ts

@@ -0,0 +1,7 @@
+import type { AutocompleteItem } from "@earendil-works/pi-tui";
+/** `@` file attachment (not `@skill` / `@plan`). */
+export declare function isAtFileAttachmentPrefix(atPrefix: string | null): boolean;
+/** List cwd-scoped entries for `@` / `@path` (Pi getFileSuggestions semantics). */
+export declare function getAtPathFileSuggestions(cwd: string, atPrefix: string): AutocompleteItem[];
+export declare function extractAtFilePrefix(textBeforeCursor: string): string | null;
+//# sourceMappingURL=at-path-mentions.d.ts.map

package/bundled/skills/at-path-mentions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"at-path-mentions.d.ts","sourceRoot":"","sources":["../../src/skills/at-path-mentions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAmH/D,oDAAoD;AACpD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAKzE;AAED,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB,EAAE,CA+E1F;AAED,wBAAgB,mBAAmB,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG3E"}

package/bundled/skills/at-path-mentions.js

@@ -0,0 +1,186 @@
+import { readdirSync, statSync } from "node:fs";
+import { basename, dirname, join, relative } from "node:path";
+import { extractAtPrefix, parsePlanMentionPrefix, parseSkillMentionPrefix, } from "./chat-mentions.js";
+function toDisplayPath(value) {
+    return value.replace(/\\/g, "/");
+}
+function parsePathPrefix(prefix) {
+    if (prefix.startsWith('@"')) {
+        return { rawPrefix: prefix.slice(2), isAtPrefix: true, isQuotedPrefix: true };
+    }
+    if (prefix.startsWith('"')) {
+        return { rawPrefix: prefix.slice(1), isAtPrefix: false, isQuotedPrefix: true };
+    }
+    if (prefix.startsWith("@")) {
+        return { rawPrefix: prefix.slice(1), isAtPrefix: true, isQuotedPrefix: false };
+    }
+    return { rawPrefix: prefix, isAtPrefix: false, isQuotedPrefix: false };
+}
+function buildCompletionValue(path, options) {
+    const needsQuotes = options.isQuotedPrefix || path.includes(" ");
+    const prefix = options.isAtPrefix ? "@" : "";
+    if (!needsQuotes) {
+        return `${prefix}${path}`;
+    }
+    const openQuote = `${prefix}"`;
+    return `${openQuote}${path}"`;
+}
+const DEPRIORITIZED_AT_PATH_NAMES = new Set([
+    "node_modules",
+    "dist",
+    "dist-bin",
+    ".turbo",
+    ".git",
+    "coverage",
+    "build",
+    ".next",
+    ".cache",
+    "tmp",
+    ".venv",
+    "target",
+]);
+const PRIORITY_AT_PATH_DIRS = [
+    "src",
+    "lib",
+    "apps",
+    "packages",
+    "scripts",
+    "test",
+    "tests",
+    "docs",
+    "spec",
+];
+const PRIORITY_AT_PATH_FILES = [
+    "package.json",
+    "README.md",
+    "readme.md",
+    "tsconfig.json",
+    "vitest.config.ts",
+    "Cargo.toml",
+    "go.mod",
+    "pyproject.toml",
+    "Makefile",
+];
+function atPathSuggestionRank(label) {
+    const name = label.replace(/\/$/, "");
+    if (PRIORITY_AT_PATH_DIRS.includes(name) ||
+        PRIORITY_AT_PATH_FILES.includes(name)) {
+        return 0;
+    }
+    if (DEPRIORITIZED_AT_PATH_NAMES.has(name)) {
+        return 3;
+    }
+    if (label.endsWith("/")) {
+        return 1;
+    }
+    return 2;
+}
+function sortAtPathSuggestions(items, rawPrefix) {
+    if (rawPrefix !== "") {
+        return items.sort((a, b) => {
+            const aIsDir = a.label.endsWith("/");
+            const bIsDir = b.label.endsWith("/");
+            if (aIsDir && !bIsDir)
+                return -1;
+            if (!aIsDir && bIsDir)
+                return 1;
+            return a.label.localeCompare(b.label);
+        });
+    }
+    return items.sort((a, b) => {
+        const rankDiff = atPathSuggestionRank(a.label) - atPathSuggestionRank(b.label);
+        if (rankDiff !== 0)
+            return rankDiff;
+        return a.label.localeCompare(b.label);
+    });
+}
+/** `@` file attachment (not `@skill` / `@plan`). */
+export function isAtFileAttachmentPrefix(atPrefix) {
+    if (!atPrefix)
+        return false;
+    if (parseSkillMentionPrefix(atPrefix))
+        return false;
+    if (parsePlanMentionPrefix(atPrefix))
+        return false;
+    return atPrefix.startsWith("@");
+}
+/** List cwd-scoped entries for `@` / `@path` (Pi getFileSuggestions semantics). */
+export function getAtPathFileSuggestions(cwd, atPrefix) {
+    try {
+        const { rawPrefix, isAtPrefix, isQuotedPrefix } = parsePathPrefix(atPrefix);
+        if (!isAtPrefix)
+            return [];
+        let searchDir;
+        let searchPrefix;
+        const expandedPrefix = rawPrefix;
+        const isRootPrefix = rawPrefix === "" ||
+            rawPrefix === "./" ||
+            rawPrefix === "../" ||
+            rawPrefix === "/" ||
+            (isAtPrefix && rawPrefix === "");
+        if (isRootPrefix) {
+            searchDir = join(cwd, expandedPrefix);
+            searchPrefix = "";
+        }
+        else if (rawPrefix.endsWith("/")) {
+            searchDir = join(cwd, expandedPrefix);
+            searchPrefix = "";
+        }
+        else {
+            searchDir = join(cwd, dirname(expandedPrefix));
+            searchPrefix = basename(expandedPrefix);
+        }
+        const entries = readdirSync(searchDir, { withFileTypes: true });
+        const suggestions = [];
+        const cwdLabel = toDisplayPath(relative(cwd, searchDir) || ".");
+        for (const entry of entries) {
+            if (!entry.name.toLowerCase().startsWith(searchPrefix.toLowerCase())) {
+                continue;
+            }
+            let isDirectory = entry.isDirectory();
+            if (!isDirectory && entry.isSymbolicLink()) {
+                try {
+                    isDirectory = statSync(join(searchDir, entry.name)).isDirectory();
+                }
+                catch {
+                    // broken symlink — treat as file
+                }
+            }
+            let relativePath;
+            const displayPrefix = rawPrefix;
+            const name = entry.name;
+            if (displayPrefix.endsWith("/")) {
+                relativePath = displayPrefix + name;
+            }
+            else if (displayPrefix.includes("/")) {
+                relativePath = join(dirname(displayPrefix), name);
+                if (displayPrefix.startsWith("./") && !relativePath.startsWith("./")) {
+                    relativePath = `./${relativePath}`;
+                }
+            }
+            else {
+                relativePath = name;
+            }
+            relativePath = toDisplayPath(relativePath);
+            const pathValue = isDirectory ? `${relativePath}/` : relativePath;
+            const value = buildCompletionValue(pathValue, { isAtPrefix, isQuotedPrefix });
+            const entryRelative = toDisplayPath(relative(cwd, join(searchDir, entry.name)));
+            suggestions.push({
+                value,
+                label: name + (isDirectory ? "/" : ""),
+                description: searchDir === cwd && rawPrefix === ""
+                    ? entryRelative
+                    : `${cwdLabel}/${entryRelative}`,
+            });
+        }
+        return sortAtPathSuggestions(suggestions, rawPrefix);
+    }
+    catch {
+        return [];
+    }
+}
+export function extractAtFilePrefix(textBeforeCursor) {
+    const atPrefix = extractAtPrefix(textBeforeCursor);
+    return isAtFileAttachmentPrefix(atPrefix) ? atPrefix : null;
+}
+//# sourceMappingURL=at-path-mentions.js.map

package/bundled/skills/at-path-mentions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"at-path-mentions.js","sourceRoot":"","sources":["../../src/skills/at-path-mentions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE9D,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IAKrC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IACjF,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAAY,EACZ,OAAyD;IAEzD,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,MAAM,GAAG,CAAC;IAC/B,OAAO,GAAG,SAAS,GAAG,IAAI,GAAG,CAAC;AAChC,CAAC;AAED,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,cAAc;IACd,MAAM;IACN,UAAU;IACV,QAAQ;IACR,MAAM;IACN,UAAU;IACV,OAAO;IACP,OAAO;IACP,QAAQ;IACR,KAAK;IACL,OAAO;IACP,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG;IAC5B,KAAK;IACL,KAAK;IACL,MAAM;IACN,UAAU;IACV,SAAS;IACT,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;CACE,CAAC;AAEX,MAAM,sBAAsB,GAAG;IAC7B,cAAc;IACd,WAAW;IACX,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,YAAY;IACZ,QAAQ;IACR,gBAAgB;IAChB,UAAU;CACF,CAAC;AAEX,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtC,IACE,qBAAqB,CAAC,QAAQ,CAAC,IAA8C,CAAC;QAC9E,sBAAsB,CAAC,QAAQ,CAAC,IAA+C,CAAC,EAChF,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAyB,EAAE,SAAiB;IACzE,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACzB,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,MAAM,IAAI,CAAC,MAAM;gBAAE,OAAO,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM,IAAI,MAAM;gBAAE,OAAO,CAAC,CAAC;YAChC,OAAO,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACzB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/E,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACpC,OAAO,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,wBAAwB,CAAC,QAAuB;IAC9D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,uBAAuB,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,sBAAsB,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,wBAAwB,CAAC,GAAW,EAAE,QAAgB;IACpE,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC5E,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAE3B,IAAI,SAAiB,CAAC;QACtB,IAAI,YAAoB,CAAC;QACzB,MAAM,cAAc,GAAG,SAAS,CAAC;QAEjC,MAAM,YAAY,GAChB,SAAS,KAAK,EAAE;YAChB,SAAS,KAAK,IAAI;YAClB,SAAS,KAAK,KAAK;YACnB,SAAS,KAAK,GAAG;YACjB,CAAC,UAAU,IAAI,SAAS,KAAK,EAAE,CAAC,CAAC;QAEnC,IAAI,YAAY,EAAE,CAAC;YACjB,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACtC,YAAY,GAAG,EAAE,CAAC;QACpB,CAAC;aAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YACtC,YAAY,GAAG,EAAE,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;YAC/C,YAAY,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,WAAW,GAAuB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC;QAEhE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACrE,SAAS;YACX,CAAC;YAED,IAAI,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,WAAW,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3C,IAAI,CAAC;oBACH,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBACP,iCAAiC;gBACnC,CAAC;YACH,CAAC;YAED,IAAI,YAAoB,CAAC;YACzB,MAAM,aAAa,GAAG,SAAS,CAAC;YAChC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YAExB,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,YAAY,GAAG,aAAa,GAAG,IAAI,CAAC;YACtC,CAAC;iBAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;gBAClD,IAAI,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrE,YAAY,GAAG,KAAK,YAAY,EAAE,CAAC;gBACrC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;YAED,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,YAAY,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;YAClE,MAAM,KAAK,GAAG,oBAAoB,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9E,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAEhF,WAAW,CAAC,IAAI,CAAC;gBACf,KAAK;gBACL,KAAK,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,WAAW,EACT,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,EAAE;oBACnC,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,GAAG,QAAQ,IAAI,aAAa,EAAE;aACrC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,qBAAqB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,gBAAwB;IAC1D,MAAM,QAAQ,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;IACnD,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC"}

package/bundled/skills/at-path-mentions.test.ts

@@ -0,0 +1,64 @@
+import { mkdtempSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { describe, expect, it } from "vitest";
+import {
+  extractAtFilePrefix,
+  getAtPathFileSuggestions,
+  isAtFileAttachmentPrefix,
+} from "./at-path-mentions.js";
+
+describe("at-path-mentions", () => {
+  it("detects file @ prefix but not skill/plan", () => {
+    expect(isAtFileAttachmentPrefix("@")).toBe(true);
+    expect(isAtFileAttachmentPrefix("@src")).toBe(true);
+    expect(isAtFileAttachmentPrefix("@skill")).toBe(false);
+    expect(isAtFileAttachmentPrefix("@skill naus")).toBe(false);
+    expect(isAtFileAttachmentPrefix("@plan")).toBe(false);
+    expect(isAtFileAttachmentPrefix("@planejar")).toBe(false);
+    expect(isAtFileAttachmentPrefix("@planful")).toBe(true);
+  });
+
+  it("extracts file @ prefix from editor text", () => {
+    expect(extractAtFilePrefix("@")).toBe("@");
+    expect(extractAtFilePrefix("read @src/")).toBe("@src/");
+    expect(extractAtFilePrefix("@skill x")).toBeNull();
+  });
+
+  it("lists immediate children of session cwd for bare @", () => {
+    const cwd = mkdtempSync(join(tmpdir(), "kubbisec-at-"));
+    mkdirSync(join(cwd, "src"));
+    writeFileSync(join(cwd, "README.md"), "# hi");
+    writeFileSync(join(cwd, "package.json"), "{}");
+
+    const items = getAtPathFileSuggestions(cwd, "@");
+    const labels = items.map((item) => item.label);
+    expect(labels).toContain("src/");
+    expect(labels).toContain("README.md");
+    expect(labels).toContain("package.json");
+    expect(items.every((item) => item.value.startsWith("@"))).toBe(true);
+  });
+
+  it("prioritizes src and package.json over node_modules for bare @", () => {
+    const cwd = mkdtempSync(join(tmpdir(), "kubbisec-at-sort-"));
+    mkdirSync(join(cwd, "node_modules"));
+    mkdirSync(join(cwd, "src"));
+    writeFileSync(join(cwd, "package.json"), "{}");
+
+    const items = getAtPathFileSuggestions(cwd, "@");
+    const labels = items.map((item) => item.label);
+    expect(labels.indexOf("src/")).toBeLessThan(labels.indexOf("node_modules/"));
+    expect(labels.indexOf("package.json")).toBeLessThan(labels.indexOf("node_modules/"));
+  });
+
+  it("filters by partial name under cwd", () => {
+    const cwd = mkdtempSync(join(tmpdir(), "kubbisec-at-"));
+    writeFileSync(join(cwd, "README.md"), "# hi");
+    writeFileSync(join(cwd, "package.json"), "{}");
+
+    const items = getAtPathFileSuggestions(cwd, "@READ");
+    expect(items).toHaveLength(1);
+    expect(items[0]?.label).toBe("README.md");
+    expect(items[0]?.value).toBe("@README.md");
+  });
+});

package/bundled/skills/at-path-mentions.ts

@@ -0,0 +1,211 @@
+import { readdirSync, statSync } from "node:fs";
+import { basename, dirname, join, relative } from "node:path";
+import type { AutocompleteItem } from "@earendil-works/pi-tui";
+import {
+  extractAtPrefix,
+  parsePlanMentionPrefix,
+  parseSkillMentionPrefix,
+} from "./chat-mentions.js";
+
+function toDisplayPath(value: string): string {
+  return value.replace(/\\/g, "/");
+}
+
+function parsePathPrefix(prefix: string): {
+  rawPrefix: string;
+  isAtPrefix: boolean;
+  isQuotedPrefix: boolean;
+} {
+  if (prefix.startsWith('@"')) {
+    return { rawPrefix: prefix.slice(2), isAtPrefix: true, isQuotedPrefix: true };
+  }
+  if (prefix.startsWith('"')) {
+    return { rawPrefix: prefix.slice(1), isAtPrefix: false, isQuotedPrefix: true };
+  }
+  if (prefix.startsWith("@")) {
+    return { rawPrefix: prefix.slice(1), isAtPrefix: true, isQuotedPrefix: false };
+  }
+  return { rawPrefix: prefix, isAtPrefix: false, isQuotedPrefix: false };
+}
+
+function buildCompletionValue(
+  path: string,
+  options: { isAtPrefix: boolean; isQuotedPrefix: boolean },
+): string {
+  const needsQuotes = options.isQuotedPrefix || path.includes(" ");
+  const prefix = options.isAtPrefix ? "@" : "";
+  if (!needsQuotes) {
+    return `${prefix}${path}`;
+  }
+  const openQuote = `${prefix}"`;
+  return `${openQuote}${path}"`;
+}
+
+const DEPRIORITIZED_AT_PATH_NAMES = new Set([
+  "node_modules",
+  "dist",
+  "dist-bin",
+  ".turbo",
+  ".git",
+  "coverage",
+  "build",
+  ".next",
+  ".cache",
+  "tmp",
+  ".venv",
+  "target",
+]);
+
+const PRIORITY_AT_PATH_DIRS = [
+  "src",
+  "lib",
+  "apps",
+  "packages",
+  "scripts",
+  "test",
+  "tests",
+  "docs",
+  "spec",
+] as const;
+
+const PRIORITY_AT_PATH_FILES = [
+  "package.json",
+  "README.md",
+  "readme.md",
+  "tsconfig.json",
+  "vitest.config.ts",
+  "Cargo.toml",
+  "go.mod",
+  "pyproject.toml",
+  "Makefile",
+] as const;
+
+function atPathSuggestionRank(label: string): number {
+  const name = label.replace(/\/$/, "");
+  if (
+    PRIORITY_AT_PATH_DIRS.includes(name as (typeof PRIORITY_AT_PATH_DIRS)[number]) ||
+    PRIORITY_AT_PATH_FILES.includes(name as (typeof PRIORITY_AT_PATH_FILES)[number])
+  ) {
+    return 0;
+  }
+  if (DEPRIORITIZED_AT_PATH_NAMES.has(name)) {
+    return 3;
+  }
+  if (label.endsWith("/")) {
+    return 1;
+  }
+  return 2;
+}
+
+function sortAtPathSuggestions(items: AutocompleteItem[], rawPrefix: string): AutocompleteItem[] {
+  if (rawPrefix !== "") {
+    return items.sort((a, b) => {
+      const aIsDir = a.label.endsWith("/");
+      const bIsDir = b.label.endsWith("/");
+      if (aIsDir && !bIsDir) return -1;
+      if (!aIsDir && bIsDir) return 1;
+      return a.label.localeCompare(b.label);
+    });
+  }
+
+  return items.sort((a, b) => {
+    const rankDiff = atPathSuggestionRank(a.label) - atPathSuggestionRank(b.label);
+    if (rankDiff !== 0) return rankDiff;
+    return a.label.localeCompare(b.label);
+  });
+}
+
+/** `@` file attachment (not `@skill` / `@plan`). */
+export function isAtFileAttachmentPrefix(atPrefix: string | null): boolean {
+  if (!atPrefix) return false;
+  if (parseSkillMentionPrefix(atPrefix)) return false;
+  if (parsePlanMentionPrefix(atPrefix)) return false;
+  return atPrefix.startsWith("@");
+}
+
+/** List cwd-scoped entries for `@` / `@path` (Pi getFileSuggestions semantics). */
+export function getAtPathFileSuggestions(cwd: string, atPrefix: string): AutocompleteItem[] {
+  try {
+    const { rawPrefix, isAtPrefix, isQuotedPrefix } = parsePathPrefix(atPrefix);
+    if (!isAtPrefix) return [];
+
+    let searchDir: string;
+    let searchPrefix: string;
+    const expandedPrefix = rawPrefix;
+
+    const isRootPrefix =
+      rawPrefix === "" ||
+      rawPrefix === "./" ||
+      rawPrefix === "../" ||
+      rawPrefix === "/" ||
+      (isAtPrefix && rawPrefix === "");
+
+    if (isRootPrefix) {
+      searchDir = join(cwd, expandedPrefix);
+      searchPrefix = "";
+    } else if (rawPrefix.endsWith("/")) {
+      searchDir = join(cwd, expandedPrefix);
+      searchPrefix = "";
+    } else {
+      searchDir = join(cwd, dirname(expandedPrefix));
+      searchPrefix = basename(expandedPrefix);
+    }
+
+    const entries = readdirSync(searchDir, { withFileTypes: true });
+    const suggestions: AutocompleteItem[] = [];
+    const cwdLabel = toDisplayPath(relative(cwd, searchDir) || ".");
+
+    for (const entry of entries) {
+      if (!entry.name.toLowerCase().startsWith(searchPrefix.toLowerCase())) {
+        continue;
+      }
+
+      let isDirectory = entry.isDirectory();
+      if (!isDirectory && entry.isSymbolicLink()) {
+        try {
+          isDirectory = statSync(join(searchDir, entry.name)).isDirectory();
+        } catch {
+          // broken symlink — treat as file
+        }
+      }
+
+      let relativePath: string;
+      const displayPrefix = rawPrefix;
+      const name = entry.name;
+
+      if (displayPrefix.endsWith("/")) {
+        relativePath = displayPrefix + name;
+      } else if (displayPrefix.includes("/")) {
+        relativePath = join(dirname(displayPrefix), name);
+        if (displayPrefix.startsWith("./") && !relativePath.startsWith("./")) {
+          relativePath = `./${relativePath}`;
+        }
+      } else {
+        relativePath = name;
+      }
+
+      relativePath = toDisplayPath(relativePath);
+      const pathValue = isDirectory ? `${relativePath}/` : relativePath;
+      const value = buildCompletionValue(pathValue, { isAtPrefix, isQuotedPrefix });
+      const entryRelative = toDisplayPath(relative(cwd, join(searchDir, entry.name)));
+
+      suggestions.push({
+        value,
+        label: name + (isDirectory ? "/" : ""),
+        description:
+          searchDir === cwd && rawPrefix === ""
+            ? entryRelative
+            : `${cwdLabel}/${entryRelative}`,
+      });
+    }
+
+    return sortAtPathSuggestions(suggestions, rawPrefix);
+  } catch {
+    return [];
+  }
+}
+
+export function extractAtFilePrefix(textBeforeCursor: string): string | null {
+  const atPrefix = extractAtPrefix(textBeforeCursor);
+  return isAtFileAttachmentPrefix(atPrefix) ? atPrefix : null;
+}

package/bundled/skills/chat-mention-render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"chat-mention-render.d.ts","sourceRoot":"","sources":["../../src/skills/chat-mention-render.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC5C,CAAC;AAsFF,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAIxF;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAqB5E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAqB5E"}
+{"version":3,"file":"chat-mention-render.d.ts","sourceRoot":"","sources":["../../src/skills/chat-mention-render.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CAC5C,CAAC;AA0IF,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAIxF;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAqB5E;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAqB5E"}