@lythos/cold-pool 0.14.5 → 0.15.0

package/README.md

@@ -2,7 +2,7 @@
 
 Cold pool service layer for the lythoskill ecosystem.
 
-> Status: 0.9.32 — public API. Reconciliation (reconcile plan) is functional; execute convergence WIP.
+> Status: stable — public API
 
 ## What this is
 
@@ -11,6 +11,16 @@ skill repositories at `~/.agents/skill-repos/` (configurable). This package
 is the **only** layer in the ecosystem that holds git side-effects.
 deck / curator / arena consume it instead of running `git clone` themselves.
 
+## CLI Commands
+
+```bash
+# Scan cold pool for unreferenced repos
+bunx @lythos/cold-pool@0.15.0 prune [--yes] [--dry-run]
+
+# Validate lock file against cold pool
+bunx @lythos/cold-pool@0.15.0 validate [--lock ./skill-deck.lock]
+```
+
 ## Architecture
 
 Three layers, sharing the project's `intent → plan → execute` pattern

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lythos/cold-pool",
-  "version": "0.14.5",
+  "version": "0.15.0",
   "description": "Cold pool service layer — dedicated resource holder for skill repositories with intent/plan/execute primitives. Single owner of git side-effects; consumed by deck/curator/arena.",
   "keywords": [
     "ai-agent",
@@ -42,7 +42,7 @@
   },
   "homepage": "https://github.com/lythos-labs/lythoskill/tree/main/packages/lythoskill-cold-pool#readme",
   "dependencies": {
-    "@lythos/infra": "^0.14.5",
+    "@lythos/infra": "^0.15.0",
     "simple-git": "^3.36.0"
   },
   "engines": {

package/src/cli.ts

@@ -51,8 +51,8 @@ async function main(): Promise<void> {
     process.exit(0)
   }
 
-  // Resolve cold pool path (env var > default)
-  const coldPoolPath = process.env.LYTHOS_COLD_POOL ?? DEFAULT_COLD_POOL_PATH
+  // Resolve cold pool path (default only; use --pool for override)
+  const coldPoolPath = DEFAULT_COLD_POOL_PATH
 
   switch (command) {
     // ── prune ─────────────────────────────────────────────────

package/src/cold-pool.ts

@@ -4,8 +4,7 @@ import { join, relative } from 'node:path'
 import type { Locator } from './types.js'
 import { MetadataDB } from './metadata-db.js'
 
-export const DEFAULT_COLD_POOL_PATH = process.env.LYTHOS_COLD_POOL
-  ?? join(homedir(), '.agents/skill-repos')
+export const DEFAULT_COLD_POOL_PATH = join(homedir(), '.agents/skill-repos')
 
 // ── DirEntry — pure, injectable fs entry ─────────────────────────────────────
 

package/src/mirror.test.ts

@@ -9,8 +9,9 @@ describe('probeConnectivity', () => {
 
   beforeEach(() => {
     originalFetch = globalThis.fetch
-    originalEnv = process.env.LYTHOSKILL_GH_MIRROR
+    originalEnv = process.env.LYTHOS_GH_MIRROR
     originalSocks = process.env.LYTHOS_SOCKS_PROXY
+    delete process.env.LYTHOS_GH_MIRROR
     delete process.env.LYTHOSKILL_GH_MIRROR
     delete process.env.LYTHOS_SOCKS_PROXY
     fetchCalls = []
@@ -19,10 +20,11 @@ describe('probeConnectivity', () => {
   afterEach(() => {
     globalThis.fetch = originalFetch
     if (originalEnv !== undefined) {
-      process.env.LYTHOSKILL_GH_MIRROR = originalEnv
+      process.env.LYTHOS_GH_MIRROR = originalEnv
     } else {
-      delete process.env.LYTHOSKILL_GH_MIRROR
+      delete process.env.LYTHOS_GH_MIRROR
     }
+    delete process.env.LYTHOSKILL_GH_MIRROR
     if (originalSocks !== undefined) {
       process.env.LYTHOS_SOCKS_PROXY = originalSocks
     } else {
@@ -67,7 +69,7 @@ describe('probeConnectivity', () => {
 
   // ── Vertical Slice 2 ──
   test('direct fails, user mirror ok → returns mirror path', async () => {
-    process.env.LYTHOSKILL_GH_MIRROR = 'https://my-mirror.example.com'
+    process.env.LYTHOS_GH_MIRROR = 'https://my-mirror.example.com'
     mockFetch(
       new Map([
         ['https://example.com/skill', new Response(null, { status: 500 })],
@@ -108,7 +110,7 @@ describe('probeConnectivity', () => {
 
   // ── Vertical Slice 5: Racing behavior ──
   test('probes race concurrently, not sequentially', async () => {
-    process.env.LYTHOSKILL_GH_MIRROR = 'https://my-mirror.example.com'
+    process.env.LYTHOS_GH_MIRROR = 'https://my-mirror.example.com'
     const start = performance.now()
 
     mockFetch(
@@ -226,7 +228,7 @@ describe('probeConnectivity', () => {
   // ── Vertical Slice 11: SOCKS proxy only affects direct, mirror still works ──
   test('SOCKS proxy fails but mirror succeeds', async () => {
     process.env.LYTHOS_SOCKS_PROXY = '127.0.0.1:1080'
-    process.env.LYTHOSKILL_GH_MIRROR = 'https://my-mirror.example.com'
+    process.env.LYTHOS_GH_MIRROR = 'https://my-mirror.example.com'
     const execCalls: Array<{ file: string; args: string[] }> = []
 
     const result = await probeConnectivity('https://example.com/skill', 3000, {
@@ -247,4 +249,30 @@ describe('probeConnectivity', () => {
     expect(result?.path).toBe('mirror')
     expect(execCalls.length).toBe(1) // only one curl call for direct probe
   })
+
+  // ── Backward compat: legacy env var name still works ──
+  test('LYTHOSKILL_GH_MIRROR (legacy) still works with deprecation warning', async () => {
+    // Ensure new name is not set
+    delete process.env.LYTHOS_GH_MIRROR
+    process.env.LYTHOSKILL_GH_MIRROR = 'https://legacy-mirror.example.com'
+    const warnCalls: string[] = []
+    const originalWarn = console.warn
+    console.warn = (...args: unknown[]) => {
+      warnCalls.push(args.map(String).join(' '))
+    }
+
+    mockFetch(
+      new Map([
+        ['https://example.com/skill', new Response(null, { status: 500 })],
+        ['https://legacy-mirror.example.com/https://example.com/skill', new Response(null, { status: 200 })],
+      ]),
+    )
+
+    const result = await probeConnectivity('https://example.com/skill')
+
+    console.warn = originalWarn
+
+    expect(result?.path).toBe('mirror')
+    expect(warnCalls.some((m) => m.includes('deprecated'))).toBe(true)
+  })
 })

package/src/mirror.ts

@@ -2,9 +2,12 @@
  * Mirror URL rewriting for restricted networks.
  *
  * Two layers only — the tool never decides which third party to trust:
- *   1. LYTHOSKILL_GH_MIRROR env var (explicit user choice, user bears trust)
+ *   1. LYTHOS_GH_MIRROR env var (explicit user choice, user bears trust)
  *   2. LYTHOS_SOCKS_PROXY / HTTPS_PROXY / HTTP_PROXY (standard, user's own infra)
  *
+ * Backward compat: LYTHOSKILL_GH_MIRROR (legacy name) is still read with a
+ * deprecation warning. Prefer LYTHOS_GH_MIRROR for consistency with the LYTHOS_
+ *
  * No hard-coded mirror list. Auto-fallback to "known" third-party mirrors was
  * removed: the tool must not silently delegate trust to an external service
  * that can return tampered skill files (see ADR-202605130...).
@@ -13,7 +16,14 @@
 import { execFileSync } from 'node:child_process'
 
 export function getMirror(): string | undefined {
-  const v = process.env.LYTHOSKILL_GH_MIRROR?.trim()
+  let v = process.env.LYTHOS_GH_MIRROR?.trim()
+  if (!v) {
+    const legacy = process.env.LYTHOSKILL_GH_MIRROR?.trim()
+    if (legacy) {
+      console.warn('⚠️  LYTHOSKILL_GH_MIRROR is deprecated. Use LYTHOS_GH_MIRROR instead.')
+      v = legacy
+    }
+  }
   if (!v) return undefined
   if (v.startsWith('http://') || v.startsWith('https://')) {
     return v.replace(/\/+$/, '')