@laitszkin/apollo-toolkit 3.3.0 → 3.3.2

package/AGENTS.md

@@ -22,7 +22,7 @@ This repository enables users to install and run a curated set of reusable agent
 - Users can research the latest completed market week and produce a PDF watchlist of tradeable instruments for the coming week.
 - Users can turn a marked weekly finance PDF into a concise evidence-based financial event report.
 - Users can install Apollo Toolkit through npm or npx and interactively choose one or more target skill directories to populate with copied or symlinked skills, with the option to include codex-exclusive skills in non-codex targets.
-- Users can uninstall all Apollo Toolkit-installed skills from all targets or specific targets via `apltk uninstall`.
+- Users can uninstall Apollo Toolkit-installed skills through an interactive target selector or specific non-interactive targets via `apltk uninstall`.
 - Users can choose between symlink mode (auto-update via git pull) and copy mode (stable snapshot) with `--symlink` / `--copy` flags.
 - Users can run bundled helper tools through `apltk tools` and direct `apltk <tool>` commands for selected packaged skill scripts.
 - Users can design and implement new features through a spec-first workflow.
@@ -79,7 +79,8 @@ This repository enables users to install and run a curated set of reusable agent
 - `./scripts/install_skills.sh all --copy` - 以複製模式安裝到所有支援目標。
 - `./scripts/install_skills.sh uninstall` - 從所有目標移除已安裝的技能。
 - `./scripts/install_skills.sh uninstall codex` - 只從 codex 目標移除。
-- `node bin/apollo-toolkit.js uninstall` - 透過 CLI 移除所有已安裝技能。
+- `node bin/apollo-toolkit.js uninstall` - 透過 CLI 互動選擇要移除的 agent target 技能。
+- `node bin/apollo-toolkit.js uninstall codex --yes` - 以非互動方式移除指定 target 的已安裝技能。
 
 ## Core Project Purpose
 

package/CHANGELOG.md

@@ -7,6 +7,22 @@ All notable changes to this repository are documented in this file.
 ### Added
 - (None yet)
 
+## [v3.3.2] - 2026-04-27
+
+### Changed
+- Tighten `version-release` so GitHub release prerelease state must come from explicit user intent or a verified repository convention, instead of being inferred from tag text such as `alpha-*`.
+
+## [v3.3.1] - 2026-04-26
+
+### Added
+- Add an interactive `apltk uninstall` target selector so users can choose which agent skill directories to remove.
+- Add `apltk uninstall --yes` for non-interactive uninstall confirmation.
+
+### Fixed
+- Fix default `apltk uninstall` cleanup so a missing OpenClaw workspace no longer prevents uninstalling Codex, Trae, Agents, or Claude Code targets.
+- Remove manifest-tracked historical skills during CLI uninstall so renamed or removed skills do not remain behind.
+- Ignore unsafe manifest skill names during install and uninstall cleanup so removals remain scoped to direct child skill directories.
+
 ## [v3.3.0] - 2026-04-26
 
 ### Added

package/README.md

@@ -82,10 +82,14 @@ The interactive installer:
 ### Uninstall
 
 ```bash
-apltk uninstall          # Remove all installed skills from all targets
-apltk uninstall codex    # Remove only from codex
+apltk uninstall                    # Choose which agent targets to uninstall
+apltk uninstall codex              # Remove only from codex
+apltk uninstall codex agents --yes # Non-interactive cleanup for selected targets
 ```
 
+The uninstall flow removes the manifest-tracked current and historical skill
+directories for the selected targets, then removes each target manifest.
+
 ### Global install
 
 ```bash

package/lib/cli.js

@@ -13,12 +13,13 @@ const {
   syncToolkitHome,
   uninstallSkills,
   getTargetRoots,
+  getUninstallTargetRoots,
 } = require('./installer');
 const { formatToolList, getToolCommand, runTool } = require('./tool-runner');
 const { checkForPackageUpdate } = require('./updater');
 
 const TARGET_OPTIONS = [
-  { id: 'all', label: 'All', description: 'Install every supported target below' },
+  { id: 'all', label: 'All', description: 'Select every supported target below' },
   ...TARGET_DEFINITIONS,
 ];
 
@@ -137,7 +138,7 @@ function buildHelpText({ version, colorEnabled }) {
     'Usage:',
     `  apltk [install] [${buildModeUsagePattern()}]...`,
     `  apollo-toolkit [install] [${buildModeUsagePattern()}]...`,
-    '  apltk uninstall',
+    `  apltk uninstall [${buildModeUsagePattern()}]... [--yes]`,
     '  apltk tools',
     '  apltk <tool> [...args]',
     '  apltk tools <tool> [...args]',
@@ -148,6 +149,7 @@ function buildHelpText({ version, colorEnabled }) {
     '  apltk',
     '  apltk codex openclaw',
     '  apltk uninstall',
+    '  apltk uninstall codex agents --yes',
     '  npx @laitszkin/apollo-toolkit',
     '  npx @laitszkin/apollo-toolkit codex openclaw',
     '  npm i -g @laitszkin/apollo-toolkit',
@@ -164,6 +166,7 @@ function buildHelpText({ version, colorEnabled }) {
     '',
     'Options:',
     '  --home <path>  Override Apollo Toolkit home directory',
+    '  --yes, -y      Skip uninstall confirmation',
     '  --help         Show this help text',
   ].join('\n');
 }
@@ -200,16 +203,24 @@ function parseArguments(argv) {
     toolName: null,
     toolArgs: [],
     linkMode: null, // 'copy' | 'symlink' | null (prompt)
+    assumeYes: false,
   };
 
   if (args[0] === 'uninstall') {
     result.command = 'uninstall';
     args.shift();
-    // remaining args could be specific modes
     while (args.length > 0) {
       const arg = args.shift();
       if (arg === '--help' || arg === '-h') {
         result.showHelp = true;
+      } else if (arg === '--yes' || arg === '-y') {
+        result.assumeYes = true;
+      } else if (arg === '--home') {
+        const toolkitHome = args.shift();
+        if (!toolkitHome) {
+          throw new Error('Missing value for --home');
+        }
+        result.toolkitHome = path.resolve(toolkitHome);
       } else {
         result.modes.push(arg);
       }
@@ -281,13 +292,21 @@ function clearScreen(output) {
   }
 }
 
-function renderSelectionScreen({ output, version, cursor, selected, message, env }) {
+function renderSelectionScreen({
+  output,
+  version,
+  cursor,
+  selected,
+  message,
+  env,
+  intro = 'Choose where Apollo Toolkit should copy managed skills.',
+}) {
   const colorEnabled = supportsColor(output, env);
   const allSelected = VALID_MODES.every((mode) => selected.has(mode));
 
   clearScreen(output);
   output.write(`${buildBanner({ version, colorEnabled })}\n\n`);
-  output.write('Choose where Apollo Toolkit should copy managed skills.\n');
+  output.write(`${intro}\n`);
   output.write(`${color('Use Up/Down', '1;33', colorEnabled)} (or ${color('j/k', '1;33', colorEnabled)}) to move, ${color('Space', '1;33', colorEnabled)} to toggle, ${color('Enter', '1;33', colorEnabled)} to continue.\n`);
   output.write(`Press ${color('a', '1;33', colorEnabled)} to toggle all, ${color('q', '1;33', colorEnabled)} to cancel.\n\n`);
 
@@ -308,13 +327,11 @@ function renderSelectionScreen({ output, version, cursor, selected, message, env
   }
 }
 
-async function promptForModes({ stdin, stdout, version, env }) {
+async function promptForSelectableModes({ stdin, stdout, version, env, intro, ttyError, cancelMessage }) {
   if (!stdin.isTTY || !stdout.isTTY) {
-    throw new Error(`Interactive install requires a TTY. Re-run with targets like ${buildInteractiveModeHint()}.`);
+    throw new Error(ttyError);
   }
 
-  await animateWelcomeScreen({ output: stdout, version, env });
-
   return new Promise((resolve, reject) => {
     let cursor = 0;
     let message = '';
@@ -348,48 +365,48 @@ async function promptForModes({ stdin, stdout, version, env }) {
       const value = chunk.toString('utf8');
       if (value === '') {
         cleanup();
-        reject(new Error('Installation cancelled.'));
+        reject(new Error(cancelMessage));
         return;
       }
 
       if (value === '' || value === 'k') {
         cursor = (cursor - 1 + TARGET_OPTIONS.length) % TARGET_OPTIONS.length;
         message = '';
-        renderSelectionScreen({ output: stdout, version, cursor, selected, message, env });
+        renderSelectionScreen({ output: stdout, version, cursor, selected, message, env, intro });
         return;
       }
 
       if (value === '' || value === 'j') {
         cursor = (cursor + 1) % TARGET_OPTIONS.length;
         message = '';
-        renderSelectionScreen({ output: stdout, version, cursor, selected, message, env });
+        renderSelectionScreen({ output: stdout, version, cursor, selected, message, env, intro });
         return;
       }
 
       if (value === ' ') {
         toggleMode(TARGET_OPTIONS[cursor].id);
         message = '';
-        renderSelectionScreen({ output: stdout, version, cursor, selected, message, env });
+        renderSelectionScreen({ output: stdout, version, cursor, selected, message, env, intro });
         return;
       }
 
       if (value.toLowerCase() === 'a') {
         toggleMode('all');
         message = '';
-        renderSelectionScreen({ output: stdout, version, cursor, selected, message, env });
+        renderSelectionScreen({ output: stdout, version, cursor, selected, message, env, intro });
         return;
       }
 
       if (value.toLowerCase() === 'q' || value === '') {
         cleanup();
-        reject(new Error('Installation cancelled.'));
+        reject(new Error(cancelMessage));
         return;
       }
 
       if (value === '\r') {
         if (selected.size === 0) {
           message = 'Select at least one target before continuing.';
-          renderSelectionScreen({ output: stdout, version, cursor, selected, message, env });
+          renderSelectionScreen({ output: stdout, version, cursor, selected, message, env, intro });
           return;
         }
 
@@ -401,7 +418,32 @@ async function promptForModes({ stdin, stdout, version, env }) {
     stdin.setRawMode(true);
     stdin.resume();
     stdin.on('data', onData);
-    renderSelectionScreen({ output: stdout, version, cursor, selected, message, env });
+    renderSelectionScreen({ output: stdout, version, cursor, selected, message, env, intro });
+  });
+}
+
+async function promptForModes({ stdin, stdout, version, env }) {
+  await animateWelcomeScreen({ output: stdout, version, env });
+  return promptForSelectableModes({
+    stdin,
+    stdout,
+    version,
+    env,
+    intro: 'Choose where Apollo Toolkit should copy managed skills.',
+    ttyError: `Interactive install requires a TTY. Re-run with targets like ${buildInteractiveModeHint()}.`,
+    cancelMessage: 'Installation cancelled.',
+  });
+}
+
+async function promptForUninstallModes({ stdin, stdout, version, env }) {
+  return promptForSelectableModes({
+    stdin,
+    stdout,
+    version,
+    env,
+    intro: 'Choose which agent skill targets Apollo Toolkit should uninstall.',
+    ttyError: `Interactive uninstall requires a TTY. Re-run with targets like ${buildInteractiveModeHint()}.`,
+    cancelMessage: 'Uninstall cancelled.',
   });
 }
 
@@ -525,7 +567,7 @@ function printUninstallSummary({ stdout, uninstallResult, env }) {
   stdout.write('\n\n');
   for (const result of uninstallResult) {
     stdout.write(`${color(result.target, '1', colorEnabled)} (${result.root})\n`);
-    stdout.write(`  Removed: ${result.removedSkills.join(', ')}\n`);
+    stdout.write(`  Removed: ${result.removedSkills.length > 0 ? result.removedSkills.join(', ') : '(manifest only)'}\n`);
   }
 }
 
@@ -563,17 +605,29 @@ async function run(argv, context = {}) {
     // --- Uninstall flow ---
     if (parsed.command === 'uninstall') {
       const toolkitHome = parsed.toolkitHome || resolveToolkitHome(env);
-      const modes = parsed.modes.length > 0 ? normalizeModes(parsed.modes) : null;
+      const modes = parsed.modes.length > 0
+        ? normalizeModes(parsed.modes)
+        : (stdin.isTTY && stdout.isTTY
+          ? normalizeModes(await promptForUninstallModes({ stdin, stdout, version: packageJson.version, env }))
+          : null);
+      const modesForLookup = modes || VALID_MODES;
+      const targets = await getUninstallTargetRoots(modesForLookup, env);
 
       // Show what will be removed
-      const allKnown = await listAllKnownSkillNames({ toolkitHome, modes: modes || [], env });
+      const allKnown = await listAllKnownSkillNames({ toolkitHome, modes: modesForLookup, env });
       stdout.write(color(`Apollo Toolkit home: ${toolkitHome}\n`, '2', supportsColor(stdout, env)));
+      if (targets.length > 0) {
+        stdout.write('Targets:\n');
+        for (const target of targets) {
+          stdout.write(`- ${target.label}: ${target.root}\n`);
+        }
+      }
 
-      const confirmed = await promptYesNo({
+      const confirmed = parsed.assumeYes || await promptYesNo({
         stdin,
         stdout,
         env,
-        question: `This will remove all Apollo Toolkit-installed skills${modes ? ` from: ${modes.join(', ')}` : ' from all targets'}. Continue?`,
+        question: `This will remove Apollo Toolkit-installed skills${modes ? ` from: ${modes.join(', ')}` : ' from all targets'}. Continue?`,
         defaultYes: false,
       });
 
@@ -688,6 +742,7 @@ module.exports = {
   buildToolsHelp,
   parseArguments,
   promptForModes,
+  promptForUninstallModes,
   promptSymlinkChoice,
   promptIncludeExclusiveSkills,
   readPackageJson,

package/lib/installer.js

@@ -122,6 +122,25 @@ async function readManifest(targetRoot) {
   }
 }
 
+function isSafeSkillName(skillName) {
+  return typeof skillName === 'string'
+    && skillName.length > 0
+    && !skillName.includes('\0')
+    && !skillName.includes('/')
+    && !skillName.includes('\\')
+    && !path.isAbsolute(skillName)
+    && !path.win32.isAbsolute(skillName)
+    && skillName !== '.'
+    && skillName !== '..';
+}
+
+function getManifestSkillNames(manifest) {
+  return [...new Set([
+    ...(Array.isArray(manifest.historicalSkills) ? manifest.historicalSkills : []),
+    ...(Array.isArray(manifest.skills) ? manifest.skills : []),
+  ])].filter(isSafeSkillName).sort();
+}
+
 // Write manifest to a target directory.
 async function writeManifest(targetRoot, { version, linkMode, skills, previousSkills = [] }) {
   const historicalSkills = [...new Set([...previousSkills, ...skills])].sort();
@@ -145,17 +164,17 @@ async function listAllKnownSkillNames({ toolkitHome, modes = [], env = process.e
   const allNames = new Set();
 
   // Current skills from toolkit home
-  const currentSkills = await listSkillNames(toolkitHome, modes);
+  const currentSkills = await listSkillNames(toolkitHome, modes).catch(() => []);
   for (const name of currentSkills) {
     allNames.add(name);
   }
 
   // Historical skills from all target manifests
-  const targets = await getTargetRoots(modes, env).catch(() => []);
+  const targets = await getUninstallTargetRoots(modes, env);
   for (const target of targets) {
     const manifest = await readManifest(target.root);
     if (manifest && manifest.historicalSkills) {
-      for (const name of manifest.historicalSkills) {
+      for (const name of getManifestSkillNames(manifest)) {
         allNames.add(name);
       }
     }
@@ -343,6 +362,21 @@ async function getTargetRoots(modes, env = process.env) {
   return targets;
 }
 
+async function getUninstallTargetRoots(modes = VALID_MODES, env = process.env) {
+  const targets = [];
+
+  for (const mode of normalizeModes(modes)) {
+    try {
+      targets.push(...await getTargetRoots([mode], env));
+    } catch {
+      // Uninstall is best-effort across agents. A missing OpenClaw workspace
+      // must not prevent cleanup from Codex, Trae, Agents, or Claude Code.
+    }
+  }
+
+  return targets;
+}
+
 async function ensureDirectory(dirPath) {
   await fsp.mkdir(dirPath, { recursive: true });
 }
@@ -387,8 +421,8 @@ async function installLinks({ toolkitHome, modes, env = process.env, previousSki
     // Read existing manifest to carry forward historical skills
     const existingManifest = await readManifest(target.root);
     const allPreviousSkills = existingManifest
-      ? [...new Set([...existingManifest.historicalSkills, ...previousSkillNames])]
-      : previousSkillNames;
+      ? [...new Set([...getManifestSkillNames(existingManifest), ...previousSkillNames.filter(isSafeSkillName)])]
+      : previousSkillNames.filter(isSafeSkillName);
 
     const staleSkillNames = allPreviousSkills.filter(
       (skillName) => !targetSkillNames.includes(skillName),
@@ -435,17 +469,18 @@ async function installLinks({ toolkitHome, modes, env = process.env, previousSki
 // Uninstall all skills from all target directories that have manifests.
 async function uninstallSkills({ env = process.env, modes = null } = {}) {
   const normalizedModes = modes ? normalizeModes(modes) : VALID_MODES;
-  const targets = await getTargetRoots(normalizedModes, env).catch(() => []);
+  const targets = await getUninstallTargetRoots(normalizedModes, env);
   const results = [];
 
   for (const target of targets) {
     const manifest = await readManifest(target.root);
-    if (!manifest || !manifest.skills || manifest.skills.length === 0) {
+    if (!manifest) {
       continue;
     }
 
+    const skillNames = getManifestSkillNames(manifest);
     const removedSkills = [];
-    for (const skillName of manifest.skills) {
+    for (const skillName of skillNames) {
       const skillPath = path.join(target.root, skillName);
       try {
         await fsp.rm(skillPath, { recursive: true, force: true });
@@ -462,13 +497,11 @@ async function uninstallSkills({ env = process.env, modes = null } = {}) {
       // ok if already gone
     }
 
-    if (removedSkills.length > 0) {
-      results.push({
-        target: target.label,
-        root: target.root,
-        removedSkills,
-      });
-    }
+    results.push({
+      target: target.label,
+      root: target.root,
+      removedSkills,
+    });
   }
 
   return results;
@@ -480,6 +513,7 @@ module.exports = {
   VALID_MODES,
   MANIFEST_FILENAME,
   getTargetRoots,
+  getUninstallTargetRoots,
   installLinks,
   listAllKnownSkillNames,
   listCodexSkillNames,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@laitszkin/apollo-toolkit",
-  "version": "3.3.0",
+  "version": "3.3.2",
   "description": "Apollo Toolkit npm installer for managed skill copying across Codex, OpenClaw, and Trae.",
   "license": "MIT",
   "author": "LaiTszKin",

package/version-release/SKILL.md

@@ -15,7 +15,7 @@ description: "Guide the agent to prepare and publish a versioned release (versio
 ## Standards
 
 - Evidence: Inspect the active change set, current version files, existing tag format, existing remote tags/releases, and root `CHANGELOG.md` `Unreleased` content before touching version files, tags, or release metadata.
-- Execution: Use this workflow only for explicit release intent, run the required quality gates when applicable, and treat every conditional gate whose scenario is met as blocking before versioning or publication; hand the repository to `submission-readiness-check` before versioning work, invoke `archive-specs` directly whenever completed plan sets should be converted or project docs need alignment, and if the worktree is already clean inspect the current version, local/remote tag state, and existing GitHub release state before deciding whether the request is already satisfied; when the user explicitly wants the same prerelease version to point at newer fixes, retarget the existing prerelease tag and GitHub release instead of inventing an extra version bump; when editing an existing GitHub prerelease during that retarget flow, use a GitHub-accepted release target such as the intended branch name if the tool or API rejects a raw commit SHA for `target_commitish`; otherwise cut the release directly from `CHANGELOG.md` `Unreleased`, update versions and docs, commit, tag, push, and publish the GitHub release with actual release tooling rather than PR-surrogate directives; run git mutations sequentially and verify both the branch tip and release tag exist remotely before publishing the GitHub release, and never treat UI git directives such as `::git-stage`, `::git-commit`, or `::git-push` as evidence that the release commit or tag already exists.
+- Execution: Use this workflow only for explicit release intent, run the required quality gates when applicable, and treat every conditional gate whose scenario is met as blocking before versioning or publication; hand the repository to `submission-readiness-check` before versioning work, invoke `archive-specs` directly whenever completed plan sets should be converted or project docs need alignment, and if the worktree is already clean inspect the current version, local/remote tag state, and existing GitHub release state before deciding whether the request is already satisfied; decide whether the GitHub release is a prerelease only from explicit user instruction or explicit repository convention already documented in the request context, never from tag naming alone; when the user explicitly wants the same prerelease version to point at newer fixes, retarget the existing prerelease tag and GitHub release instead of inventing an extra version bump; when editing an existing GitHub prerelease during that retarget flow, use a GitHub-accepted release target such as the intended branch name if the tool or API rejects a raw commit SHA for `target_commitish`; otherwise cut the release directly from `CHANGELOG.md` `Unreleased`, update versions and docs, commit, tag, push, and publish the GitHub release with actual release tooling rather than PR-surrogate directives; run git mutations sequentially and verify both the branch tip and release tag exist remotely before publishing the GitHub release, and never treat UI git directives such as `::git-stage`, `::git-commit`, or `::git-push` as evidence that the release commit or tag already exists.
 - Quality: Never guess versions, align user-facing docs with actual code, do not bypass readiness blockers from `submission-readiness-check`, do not reconstruct release notes from `git diff` when curated changelog content already exists, and do not report release success until the commit, tag, and GitHub release all exist for the same version.
 - Output: Produce a versioned release commit and tag, publish a matching GitHub release, and keep changelog plus relevant repository documentation synchronized.
 
@@ -69,6 +69,7 @@ Load only when needed:
    - Read existing version files (for example `project.toml`, `package.json`, or repo-specific version files).
    - Infer existing tag format (`vX.Y.Z` or `X.Y.Z`) from repository tags.
    - Inspect existing local and remote tags plus any existing GitHub Release for the target version before creating new release metadata, so duplicate or conflicting releases are caught early.
+   - Determine release channel explicitly before publishing: if the user did not say `prerelease`, `draft`, `latest`, or an equivalent repository-specific release state, default to asking or to the repository's already-documented convention instead of inferring from the tag text.
    - If the user explicitly asks to keep the same prerelease version or to `repoint`, `retarget`, or `move` an existing prerelease after follow-up fixes, treat that as a retarget flow: keep the version unchanged, confirm the existing prerelease tag/release name, and plan to move that tag/release to the new commit instead of bumping semver.
    - If the requested version tag and matching published GitHub release already exist and point at the intended commit, report that the release is already complete instead of creating duplicate metadata.
    - If the user provides the target version, use it directly.
@@ -101,6 +102,7 @@ Load only when needed:
    - If any git step finishes ambiguously or the remote hashes do not match local state, rerun the missing step sequentially and re-check before publishing the GitHub release.
 10. Publish the GitHub release
    - Create a non-draft GitHub release that matches the pushed version tag.
+   - Set the GitHub release's prerelease flag only when the user explicitly asked for a prerelease or an already-verified repository convention for this exact release channel requires it.
    - For prerelease retarget flows, update the existing GitHub prerelease so it points at the rewritten tag/commit and refresh its notes when the new fix changes the shipped behavior.
    - If the release tool rejects a raw commit SHA while updating `target_commitish`, retry with the authoritative branch name or another GitHub-accepted target identifier, then verify the published release now resolves to the rewritten tag.
    - Use the release notes from the new `CHANGELOG.md` entry unless the repository has a stronger established release-note source.