@ngocsangairvds/vsaf 4.1.5 → 4.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ngocsangairvds/vsaf",
-  "version": "4.1.5",
+  "version": "4.1.7",
   "description": "logging step",
   "main": "packages/core/dist/index.js",
   "types": "packages/core/dist/index.d.ts",

package/skills/vds-skill/_shared/config-check.js

@@ -5,11 +5,11 @@
  * config-check.js — reusable pre-flight checker for vds-skill-* SKILL.md files.
  *
  * Usage:
- *   node config-check.js --cmd vds-cli --env VDS_CONFLUENCE_TOKEN,VDS_CONFLUENCE_SPACE_DEFAULT
+ *   node config-check.js --cmd vds-cli --env INTERNAL_CONFLUENCE_TOKEN
  *
  * Output (matches legacy bash format):
  *   OK                                          — all checks pass
- *   BLOCKED — missing: vds-cli VDS_JIRA_TOKEN   — something missing
+ *   BLOCKED — missing: vds-cli JIRA_TOKEN       — something missing
  *   NOTE: /path/to/cmd exists but fails to run  — broken shim detected
  */
 
@@ -72,5 +72,5 @@ if (missing.length === 0) {
   console.log('OK');
 } else {
   console.log(`BLOCKED — missing: ${missing.join(' ')}`);
-  console.log('Fix: edit ~/.vds/sdlc-config.env (or run: vsaf install vds-skill)');
+  console.log('Fix: edit ~/.vds/.env (or run: vsaf install vds-skill)');
 }

package/skills/vds-skill/_shared/credentials.js

@@ -9,7 +9,7 @@ const { execFileSync } = require('child_process');
 const IS_WIN = process.platform === 'win32';
 
 function getConfigPath() {
-  return process.env.VSAF_CONFIG_FILE || join(homedir(), '.vds', 'sdlc-config.env');
+  return process.env.VSAF_CONFIG_FILE || join(homedir(), '.vds', '.env');
 }
 
 function parseEnvFile(filePath) {

package/skills/vds-skill/create-bitbucket-pr/SKILL.md

@@ -12,7 +12,7 @@ Create a Bitbucket PR on Viettel internal Bitbucket via `vds-cli`.
 Before doing anything, run this check via Bash tool:
 
 ```bash
-node .claude/skills/_shared/vds-skill/config-check.js --cmd vds-cli --env VDS_BITBUCKET_TOKEN
+node .claude/skills/_shared/vds-skill/config-check.js --cmd vds-cli --env BITBUCKET_TOKEN
 ```
 
 If BLOCKED: tell the user exactly what's missing and how to fix, then STOP. Do NOT fabricate output. `--dry-run` mode skips credential + vds-cli checks.
@@ -22,7 +22,7 @@ If BLOCKED: tell the user exactly what's missing and how to fix, then STOP. Do N
 - `vds-cli` installed (for non-dry-run)
 - Inside a git repo with remote pointing to `bitbucket.digital.vn`
 - On a named branch (not detached HEAD)
-- `VDS_BITBUCKET_TOKEN` in `~/.vds/sdlc-config.env`
+- `BITBUCKET_TOKEN` in `~/.vds/.env`
 
 ## Usage
 
@@ -40,7 +40,7 @@ If BLOCKED: tell the user exactly what's missing and how to fix, then STOP. Do N
 2. Extract PROJECT/REPO from remote URL
 3. Determine source branch (current) + target (default `master`)
 4. Auto-detect description from `.vsaf/docs/features/*/09-ship.md` or `.vsaf/docs/hotfixes/*/03-ship.md`
-5. Lazy-prompt `VDS_BITBUCKET_TOKEN` if not set
+5. Lazy-prompt `BITBUCKET_TOKEN` if not set
 6. Confirm with user before executing
 7. Run `vds-cli bitbucket pr create $PROJECT/$REPO --source ... --target ... --title ... --description-file ... --yes --json-only`
 

package/skills/vds-skill/create-bitbucket-pr/scripts/create-pr.js

@@ -106,7 +106,7 @@ if (!cmdCheck.found) {
 }
 
 (async () => {
-  if (!await ensureEnv('VDS_BITBUCKET_TOKEN', 'Enter VDS Bitbucket personal access token')) process.exit(1);
+  if (!await ensureEnv('BITBUCKET_TOKEN', 'Enter Bitbucket personal access token')) process.exit(1);
 
   console.log('About to create PR:');
   console.log(`  Project/Repo: ${project}/${repo}`);

package/skills/vds-skill/create-jira-epic/SKILL.md

@@ -12,7 +12,7 @@ Create a Jira Epic on Viettel Jira based on a PRD markdown file.
 Before doing anything, run this check via Bash tool:
 
 ```bash
-node .claude/skills/_shared/vds-skill/config-check.js --cmd vds-cli --env VDS_JIRA_TOKEN,VDS_JIRA_PROJECT_DEFAULT
+node .claude/skills/_shared/vds-skill/config-check.js --cmd vds-cli --env JIRA_TOKEN,VDS_JIRA_PROJECT_DEFAULT
 ```
 
 If BLOCKED: tell the user exactly what's missing and how to fix, then STOP. Do NOT fabricate output. `--dry-run` mode skips credential + vds-cli checks.
@@ -21,7 +21,7 @@ If BLOCKED: tell the user exactly what's missing and how to fix, then STOP. Do N
 
 - `vds-cli` installed (for non-dry-run)
 - A PRD file exists at `.vsaf/docs/features/{feature}/02-prd.md`
-- `VDS_JIRA_TOKEN` + `VDS_JIRA_PROJECT_DEFAULT` in `~/.vds/sdlc-config.env`
+- `JIRA_TOKEN` + `VDS_JIRA_PROJECT_DEFAULT` in `~/.vds/.env`
 
 ## Usage
 
@@ -37,7 +37,7 @@ If BLOCKED: tell the user exactly what's missing and how to fix, then STOP. Do N
 
 1. Locate PRD file (or use `--description-file`)
 2. Extract summary from PRD's first H1 heading
-3. Lazy-prompt `VDS_JIRA_TOKEN` + `VDS_JIRA_PROJECT_DEFAULT` if missing
+3. Lazy-prompt `JIRA_TOKEN` + `VDS_JIRA_PROJECT_DEFAULT` if missing
 4. Confirm with user
 5. Run `vds-cli jira create --project KEY --issuetype Epic --summary ... --description-file ... --yes --json-only`
 6. Save returned epic key to `<feature-dir>/jira-epic-key.txt`

package/skills/vds-skill/create-jira-epic/scripts/create-epic.js

@@ -76,7 +76,7 @@ if (!cmdCheck.found) {
 }
 
 (async () => {
-  if (!await ensureEnv('VDS_JIRA_TOKEN', 'Enter VDS Jira personal access token')) process.exit(1);
+  if (!await ensureEnv('JIRA_TOKEN', 'Enter Jira personal access token')) process.exit(1);
   if (!await ensureEnv('VDS_JIRA_PROJECT_DEFAULT', 'Enter default Jira project key (e.g. NTTC)', false)) process.exit(1);
 
   projectKey = projectKey || process.env.VDS_JIRA_PROJECT_DEFAULT;

package/skills/vds-skill/install-deps.mjs

@@ -3,8 +3,8 @@
 /**
  * VDS Skill Pack — credential & config setup
  *
- * Creates ~/.vds/sdlc-config.env template with all required
- * environment variables for vds-skill-* skills.
+ * Merges credential stubs into ~/.vds/.env (the shared VDS env file
+ * that all orchestrators read via pydantic-settings).
  *
  * Usage:
  *   node install-deps.mjs [projectPath]
@@ -20,14 +20,19 @@ const packDir = process.argv[3] || dirname(new URL(import.meta.url).pathname);
 // ── Config ──
 
 const VDS_DIR = join(homedir(), '.vds');
-const CONFIG_FILE = join(VDS_DIR, 'sdlc-config.env');
+const CONFIG_FILE = join(VDS_DIR, '.env');
 
 const REQUIRED_VARS = [
-  { name: 'VDS_CONFLUENCE_TOKEN', desc: 'Confluence personal access token', skills: 'push-prd, push-srs, search-confluence' },
-  { name: 'VDS_JIRA_TOKEN', desc: 'Jira personal access token', skills: 'create-jira-epic, search-confluence' },
-  { name: 'VDS_BITBUCKET_TOKEN', desc: 'Bitbucket personal access token', skills: 'create-bitbucket-pr' },
-  { name: 'VDS_CONFLUENCE_SPACE_DEFAULT', desc: 'Default Confluence space key (e.g. CEP)', skills: 'push-prd, push-srs, search-confluence' },
-  { name: 'VDS_JIRA_PROJECT_DEFAULT', desc: 'Default Jira project key (e.g. NTTC)', skills: 'create-jira-epic, search-confluence' },
+  // Personal Access Tokens — primary auth (one token per service)
+  { name: 'INTERNAL_CONFLUENCE_TOKEN', desc: 'Confluence internal server PAT', skills: 'push-prd, push-srs, search-confluence' },
+  { name: 'JIRA_TOKEN', desc: 'Jira personal access token', skills: 'create-jira-epic, search-confluence' },
+  { name: 'BITBUCKET_TOKEN', desc: 'Bitbucket personal access token', skills: 'create-bitbucket-pr' },
+];
+
+// Optional — basic auth fallback (only needed if PATs not available)
+const OPTIONAL_VARS = [
+  { name: 'VDS_USERNAME', desc: 'VDS username (basic auth fallback)', skills: 'confluence, jira, bitbucket' },
+  { name: 'VDS_PASSWORD', desc: 'VDS password (basic auth fallback)', skills: 'confluence, jira, bitbucket' },
 ];
 
 // ── Helpers ──
@@ -75,12 +80,14 @@ for (const v of REQUIRED_VARS) {
 if (!existsSync(CONFIG_FILE)) {
   // Create fresh template
   const lines = [
-    '# VDS Skill Pack — credential config',
-    '# File: ~/.vds/sdlc-config.env',
-    '# Permissions: 600 (auto-set by credentials.js)',
+    '# VDS shared environment — credential config',
+    '# File: ~/.vds/.env',
+    '# Permissions: 600 (auto-set by installer)',
     '#',
-    '# Fill in the values below. Skills will use these automatically.',
-    '# To rotate a token: update the value here, skills pick it up next run.',
+    '# Set per-service Personal Access Tokens (recommended):',
+    '#   INTERNAL_CONFLUENCE_TOKEN, JIRA_TOKEN, BITBUCKET_TOKEN',
+    '# Or basic auth fallback: VDS_USERNAME + VDS_PASSWORD (works for all services)',
+    '# To rotate a credential: update the value here, orchestrators pick it up next run.',
     '',
   ];
 
@@ -91,6 +98,14 @@ if (!existsSync(CONFIG_FILE)) {
     lines.push('');
   }
 
+  lines.push('# --- Basic auth fallback (optional, only if PATs not available) ---');
+  lines.push('');
+  for (const v of OPTIONAL_VARS) {
+    lines.push(`# ${v.desc}`);
+    lines.push(`# ${v.name}=`);
+  }
+  lines.push('');
+
   writeFileSync(CONFIG_FILE, lines.join('\n'));
   if (process.platform !== 'win32') {
     chmodSync(CONFIG_FILE, 0o600);
@@ -193,7 +208,10 @@ if (!vdsCliFound && vdsScriptsDir) {
   // Check vds-scripts has valid structure (pyproject.toml = uv project)
   if (existsSync(join(vdsScriptsDir, 'pyproject.toml'))) {
     mkdirSync(wrapperDir, { recursive: true });
-    const wrapperContent = `#!/usr/bin/env node
+
+    if (process.platform === 'win32') {
+      // Windows: Node.js wrapper + .cmd shim
+      const wrapperContent = `#!/usr/bin/env node
 // Project-local vds-cli wrapper — created by vsaf install vds-skill
 const { execFileSync } = require('child_process');
 try {
@@ -202,20 +220,53 @@ try {
   process.exit(e.status || 1);
 }
 `;
-    writeFileSync(wrapperPath, wrapperContent);
-    if (process.platform !== 'win32') {
-      chmodSync(wrapperPath, 0o755);
-    } else {
+      writeFileSync(wrapperPath, wrapperContent);
       writeFileSync(wrapperPath + '.cmd', `@node "%~dp0\\vds-cli" %*\r\n`);
+    } else {
+      // Unix: pure bash wrapper — no node/nvm dependency
+      const wrapperContent = `#!/usr/bin/env bash
+# Project-local vds-cli wrapper — created by vsaf install vds-skill
+# Uses bash instead of node to avoid nvm/node PATH issues
+exec uv run --directory ${JSON.stringify(vdsScriptsDir)} --package vds-cli vds-cli "$@"
+`;
+      writeFileSync(wrapperPath, wrapperContent);
+      chmodSync(wrapperPath, 0o755);
     }
     log('✅', `vds-cli wrapper created: ${wrapperPath}`);
     log('  ', `Points to: ${vdsScriptsDir}`);
-    if (process.platform === 'win32') {
-      log('💡', 'Add to PATH:  set "PATH=.claude\\bin;%PATH%"');
-      log('  ', 'PowerShell:   $env:PATH = ".claude\\bin;$env:PATH"');
-    } else {
-      log('💡', 'Add to PATH:  export PATH=".claude/bin:$PATH"');
+
+    // Auto-register .claude/bin in CLAUDE.md so Claude Code always finds vds-cli
+    const claudeMdPath = join(projectPath, 'CLAUDE.md');
+    try {
+      const content = existsSync(claudeMdPath) ? readFileSync(claudeMdPath, 'utf-8') : '';
+      const pathExport = 'export PATH=".claude/bin:$PATH"';
+      if (!content.includes('.claude/bin')) {
+        const block = `\n\n## vds-cli PATH\n\nBefore running any \`vds-cli\` command, prepend the local bin directory:\n\`\`\`bash\n${pathExport}\n\`\`\`\nOr use the full path: \`.claude/bin/vds-cli\`\n`;
+        writeFileSync(claudeMdPath, content + block);
+        log('✅', 'PATH hint added to CLAUDE.md');
+      }
+    } catch {
+      // CLAUDE.md update is best-effort
     }
+
+    // Also add Bash permission for .claude/bin/vds-cli in settings.local.json
+    const settingsPath = join(projectPath, '.claude', 'settings.local.json');
+    try {
+      const settings = existsSync(settingsPath)
+        ? JSON.parse(readFileSync(settingsPath, 'utf-8'))
+        : {};
+      if (!settings.permissions) settings.permissions = {};
+      if (!settings.permissions.allow) settings.permissions.allow = [];
+      const vdsRule = 'Bash(.claude/bin/vds-cli *)';
+      if (!settings.permissions.allow.some(r => r.includes('.claude/bin/vds-cli'))) {
+        settings.permissions.allow.push(vdsRule);
+        writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
+        log('✅', 'vds-cli permission added to settings.local.json');
+      }
+    } catch {
+      // settings update is best-effort
+    }
+
     vdsCliFound = true;
   }
 }

package/skills/vds-skill/push-prd/SKILL.md

@@ -17,7 +17,7 @@ Publish the current PRD to Viettel Confluence via `vds-cli` — create a new pag
 Before doing anything, run this check via Bash tool:
 
 ```bash
-node .claude/skills/_shared/vds-skill/config-check.js --cmd vds-cli --env VDS_CONFLUENCE_TOKEN,VDS_CONFLUENCE_SPACE_DEFAULT
+node .claude/skills/_shared/vds-skill/config-check.js --cmd vds-cli --env INTERNAL_CONFLUENCE_TOKEN,VDS_CONFLUENCE_SPACE_DEFAULT
 ```
 
 If BLOCKED: tell the user exactly what's missing and how to fix, then STOP. Do NOT fabricate output.
@@ -26,7 +26,7 @@ If BLOCKED: tell the user exactly what's missing and how to fix, then STOP. Do N
 
 - `vds-cli` installed
 - A PRD markdown file must exist
-- `VDS_CONFLUENCE_TOKEN` + `VDS_CONFLUENCE_SPACE_DEFAULT` in `~/.vds/sdlc-config.env`
+- `INTERNAL_CONFLUENCE_TOKEN` + `VDS_CONFLUENCE_SPACE_DEFAULT` in `~/.vds/.env`
 - Confluence parent page configured in `.vsaf/config.yaml` (or lazy-prompted)
 
 ## Steps

package/skills/vds-skill/push-srs/SKILL.md

@@ -17,7 +17,7 @@ Publish the current SRS to Viettel Confluence via `vds-cli` — create or update
 Before doing anything, run this check via Bash tool:
 
 ```bash
-node .claude/skills/_shared/vds-skill/config-check.js --cmd vds-cli --env VDS_CONFLUENCE_TOKEN,VDS_CONFLUENCE_SPACE_DEFAULT
+node .claude/skills/_shared/vds-skill/config-check.js --cmd vds-cli --env INTERNAL_CONFLUENCE_TOKEN,VDS_CONFLUENCE_SPACE_DEFAULT
 ```
 
 If BLOCKED: tell the user exactly what's missing and how to fix, then STOP. Do NOT fabricate output.
@@ -26,7 +26,7 @@ If BLOCKED: tell the user exactly what's missing and how to fix, then STOP. Do N
 
 - `vds-cli` installed
 - An SRS markdown file must exist
-- `VDS_CONFLUENCE_TOKEN` + `VDS_CONFLUENCE_SPACE_DEFAULT` in `~/.vds/sdlc-config.env`
+- `INTERNAL_CONFLUENCE_TOKEN` + `VDS_CONFLUENCE_SPACE_DEFAULT` in `~/.vds/.env`
 - Confluence parent page in config or lazy-prompted
 
 ## Steps

package/skills/vds-skill/search-confluence/SKILL.md

@@ -12,7 +12,7 @@ Search Viettel Confluence + Jira for pages/tickets related to a feature, then wr
 Before doing anything, run this check via Bash tool:
 
 ```bash
-node .claude/skills/_shared/vds-skill/config-check.js --cmd vds-cli --env VDS_CONFLUENCE_TOKEN,VDS_JIRA_TOKEN,VDS_CONFLUENCE_SPACE_DEFAULT,VDS_JIRA_PROJECT_DEFAULT
+node .claude/skills/_shared/vds-skill/config-check.js --cmd vds-cli --env INTERNAL_CONFLUENCE_TOKEN,JIRA_TOKEN,VDS_CONFLUENCE_SPACE_DEFAULT,VDS_JIRA_PROJECT_DEFAULT
 ```
 
 If BLOCKED: tell the user exactly what's missing and how to fix, then STOP. Do NOT fabricate output. `--dry-run` mode skips vds-cli check.
@@ -21,7 +21,7 @@ If BLOCKED: tell the user exactly what's missing and how to fix, then STOP. Do N
 
 - `vds-cli` installed
 - Inside a project root with `.vsaf/docs/features/`
-- `VDS_CONFLUENCE_TOKEN`, `VDS_JIRA_TOKEN`, `VDS_CONFLUENCE_SPACE_DEFAULT`, `VDS_JIRA_PROJECT_DEFAULT` in `~/.vds/sdlc-config.env`
+- `INTERNAL_CONFLUENCE_TOKEN`, `JIRA_TOKEN`, `VDS_CONFLUENCE_SPACE_DEFAULT`, `VDS_JIRA_PROJECT_DEFAULT` in `~/.vds/.env`
 
 ## Usage
 

package/skills/vds-skill/search-confluence/scripts/search.js

@@ -57,8 +57,8 @@ if (!cmdCheck.found) {
 }
 
 (async () => {
-  if (!await ensureEnv('VDS_CONFLUENCE_TOKEN', 'Enter VDS Confluence personal access token')) process.exit(1);
-  if (!await ensureEnv('VDS_JIRA_TOKEN', 'Enter VDS Jira personal access token')) process.exit(1);
+  if (!await ensureEnv('INTERNAL_CONFLUENCE_TOKEN', 'Enter Confluence internal server PAT')) process.exit(1);
+  if (!await ensureEnv('JIRA_TOKEN', 'Enter Jira personal access token')) process.exit(1);
   if (!await ensureEnv('VDS_CONFLUENCE_SPACE_DEFAULT', 'Enter default Confluence space key (e.g. ENG)', false)) process.exit(1);
   if (!await ensureEnv('VDS_JIRA_PROJECT_DEFAULT', 'Enter default Jira project key (e.g. NTTC)', false)) process.exit(1);
 

package/skills/vds-skill/vds-scripts-skill/SKILL.md

@@ -48,19 +48,22 @@ Do **not** use this skill as the authoritative deep runbook for:
 
 ## Primary Command Entry Points
 
+**Resolution order** — try each in sequence, use the first that works:
+
 ```bash
-# Via vds-cli on PATH (recommended — MCP-registered)
+# 1. Project-local wrapper (recommended — works with nvm, no PATH setup needed)
+.claude/bin/vds-cli --help
+.claude/bin/vds-cli confluence --help
+.claude/bin/vds-cli jira --help
+.claude/bin/vds-cli bitbucket --help
+
+# 2. On PATH (if user added .claude/bin to PATH or installed globally)
 vds-cli --help
-vds-cli confluence --help
-vds-cli jira --help
-vds-cli bitbucket --help
-vds-cli git --help
 
-# Direct uv invocation — project-local
+# 3. Direct uv invocation — project-local fallback
 uv run --directory .claude/vds-scripts --package vds-cli vds-cli --help
-uv run --directory .claude/vds-scripts --package audit_orchestrator vds-audit --help
 
-# Direct uv invocation — global fallback
+# 4. Direct uv invocation — global fallback
 uv run --directory ~/.claude/vds-scripts --package vds-cli vds-cli --help
 ```