@ngocsangairvds/vsaf 4.1.8 → 4.1.10

package/skills/vds-skill/install-deps.mjs

@@ -1,40 +1,35 @@
 #!/usr/bin/env node
 
 /**
- * VDS Skill Pack — credential & config setup
+ * VDS Skill Pack — dependency installer
  *
- * Merges credential stubs into ~/.vds/.env (the shared VDS env file
- * that all orchestrators read via pydantic-settings).
+ * Cross-platform (Windows, Linux, macOS).
  *
  * Usage:
- *   node install-deps.mjs [projectPath]
+ *   node install-deps.mjs <projectPath> <packDir> [--force]
+ *
+ * What it does:
+ *   1. Checks Python >= 3.14
+ *   2. Ensures uv is installed
+ *   3. Copies runtime to ~/.claude/vds-scripts/
+ *   4. Runs uv sync
+ *   5. Provisions .env template at ~/.vds/.env
  */
 
-import { existsSync, readFileSync, writeFileSync, mkdirSync, cpSync, chmodSync, unlinkSync, renameSync } from 'fs';
-import { join, dirname, delimiter } from 'path';
+import { execSync } from 'child_process';
+import { existsSync, cpSync, mkdirSync, writeFileSync, rmSync } from 'fs';
+import { join } from 'path';
 import { homedir } from 'os';
 
-const projectPath = process.argv[2] || process.cwd();
-const packDir = process.argv[3] || dirname(new URL(import.meta.url).pathname);
-const skipMigration = process.argv.includes('--skip-migration');
-
-// ── Config ──
-
-const VDS_DIR = join(homedir(), '.vds');
-const CONFIG_FILE = join(VDS_DIR, '.env');
-
-const REQUIRED_VARS = [
-  // Personal Access Tokens — primary auth (one token per service)
-  { name: 'INTERNAL_CONFLUENCE_TOKEN', desc: 'Confluence internal server PAT', skills: 'push-prd, push-srs, search-confluence' },
-  { name: 'JIRA_TOKEN', desc: 'Jira personal access token', skills: 'create-jira-epic, search-confluence' },
-  { name: 'BITBUCKET_TOKEN', desc: 'Bitbucket personal access token', skills: 'create-bitbucket-pr' },
-];
+const IS_WIN = process.platform === 'win32';
+const IS_MAC = process.platform === 'darwin';
+const PYTHON = IS_WIN ? 'python' : 'python3';
+const VDS_DIR = join(homedir(), '.claude', 'vds-scripts');
+const ENV_DIR = join(homedir(), '.vds');
+const ENV_FILE = join(ENV_DIR, '.env');
 
-// Optional — basic auth fallback (only needed if PATs not available)
-const OPTIONAL_VARS = [
-  { name: 'VDS_USERNAME', desc: 'VDS username (basic auth fallback)', skills: 'confluence, jira, bitbucket' },
-  { name: 'VDS_PASSWORD', desc: 'VDS password (basic auth fallback)', skills: 'confluence, jira, bitbucket' },
-];
+const [, , projectPath, packDir] = process.argv;
+const force = process.argv.includes('--force');
 
 // ── Helpers ──
 
@@ -42,526 +37,202 @@ function log(icon, msg) {
   console.log(`  ${icon} ${msg}`);
 }
 
-function parseExistingConfig(filePath) {
-  if (!existsSync(filePath)) return {};
-  const vars = {};
-  for (const line of readFileSync(filePath, 'utf-8').split('\n')) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith('#')) continue;
-    const eq = trimmed.indexOf('=');
-    if (eq > 0) {
-      const key = trimmed.slice(0, eq);
-      const val = trimmed.slice(eq + 1).replace(/^['"]|['"]$/g, '');
-      if (val) vars[key] = val;
-    }
+// ── 1. Check Python >= 3.14 ──
+
+function checkPython() {
+  try {
+    const output = execSync(`${PYTHON} --version`, { encoding: 'utf-8', stdio: 'pipe' });
+    const match = output.match(/Python (\d+)\.(\d+)/);
+    if (!match) {
+      printPythonGuide();
+      process.exit(1);
+    }
+    const major = Number(match[1]);
+    const minor = Number(match[2]);
+    if (major < 3 || (major === 3 && minor < 14)) {
+      printPythonGuide(major, minor);
+      process.exit(1);
+    }
+    return `${major}.${minor}`;
+  } catch {
+    printPythonGuide();
+    process.exit(1);
   }
-  return vars;
 }
 
-// ── Migration: sdlc-config.env → .env ──
-
-const LEGACY_CONFIG = join(VDS_DIR, 'sdlc-config.env');
-
-const VAR_MAPPING = {
-  'VDS_CONFLUENCE_TOKEN': 'INTERNAL_CONFLUENCE_TOKEN',
-  'VDS_JIRA_TOKEN': 'JIRA_TOKEN',
-  'VDS_BITBUCKET_TOKEN': 'BITBUCKET_TOKEN',
-  'VDS_USERNAME': 'VDS_USERNAME',
-  'VDS_PASSWORD': 'VDS_PASSWORD',
-  'VDS_CONFLUENCE_SPACE_DEFAULT': 'VDS_CONFLUENCE_SPACE_DEFAULT',
-  'VDS_JIRA_PROJECT_DEFAULT': 'VDS_JIRA_PROJECT_DEFAULT',
-};
-
-const PLACEHOLDERS = new Set([
-  'changeme', '<your-token>', 'xxx', 'todo',
-  'your-confluence-token', 'your-jira-token', 'your-bitbucket-token',
-]);
-
-function parseLegacyEnv(filePath) {
-  if (!existsSync(filePath)) return {};
-  let raw = readFileSync(filePath);
-  // Strip UTF-8 BOM
-  if (raw[0] === 0xEF && raw[1] === 0xBB && raw[2] === 0xBF) {
-    raw = raw.subarray(3);
-  }
-  const text = raw.toString('utf-8');
-  const vars = {};
-  for (const rawLine of text.split(/\r?\n/)) {
-    let line = rawLine.trim();
-    if (!line || line.startsWith('#')) continue;
-    if (line.startsWith('export ')) line = line.slice(7).trimStart();
-    const eq = line.indexOf('=');
-    if (eq <= 0) continue;
-    const key = line.slice(0, eq).trim();
-    let val = line.slice(eq + 1).trim();
-    if (val.length >= 2 && val[0] === val[val.length - 1] && (val[0] === "'" || val[0] === '"')) {
-      val = val.slice(1, -1);
-    }
-    if (val) vars[key] = val;
+function printPythonGuide(major, minor) {
+  const current = major ? `${major}.${minor}` : 'not found';
+  console.error(`\n  ✗ Python >= 3.14 required (current: ${current})\n`);
+  if (IS_WIN) {
+    console.error('    Install: winget install Python.Python.3.14');
+    console.error('    Or download from: https://www.python.org/downloads/\n');
+  } else if (IS_MAC) {
+    console.error('    Install: brew install python@3.14\n');
+  } else {
+    console.error('    Install: sudo apt install python3.14');
+    console.error('    Or use pyenv: pyenv install 3.14\n');
   }
-  return vars;
 }
 
-function migrateSdlcConfig() {
-  if (!existsSync(LEGACY_CONFIG)) {
-    log('ℹ️', 'No legacy sdlc-config.env found — skip migration.');
-    return;
-  }
+// ── 2. Ensure uv ──
 
-  const legacy = parseLegacyEnv(LEGACY_CONFIG);
-  if (Object.keys(legacy).length === 0) {
-    log('ℹ️', 'sdlc-config.env is empty — skip migration.');
-    return;
+function resolveUv() {
+  // 1. On PATH?
+  try {
+    execSync('uv --version', { stdio: 'pipe' });
+    return 'uv';
+  } catch { /* not on PATH */ }
+
+  // 2. Check common install locations
+  const fallbacks = IS_WIN
+    ? [
+        join(homedir(), '.local', 'bin', 'uv.exe'),
+        join(process.env.LOCALAPPDATA || '', 'uv', 'uv.exe'),
+      ]
+    : [
+        join(homedir(), '.local', 'bin', 'uv'),
+        join(homedir(), '.cargo', 'bin', 'uv'),
+      ];
+
+  for (const p of fallbacks) {
+    try {
+      execSync(`"${p}" --version`, { stdio: 'pipe' });
+      return `"${p}"`;
+    } catch { /* not here */ }
   }
 
-  const target = parseExistingConfig(CONFIG_FILE);
+  return null;
+}
 
-  const toWrite = {};
-  const migrated = [];
-  const skipped = [];
-  const warnings = [];
+function ensureUv() {
+  let uv = resolveUv();
+  if (uv) return uv;
 
-  for (const [oldKey, value] of Object.entries(legacy)) {
-    if (!(oldKey in VAR_MAPPING)) {
-      warnings.push(oldKey);
-      continue;
-    }
-    const newKey = VAR_MAPPING[oldKey];
-    if (PLACEHOLDERS.has(value.toLowerCase())) {
-      skipped.push(oldKey);
-      continue;
-    }
-    // Don't overwrite real values
-    const existing = target[newKey] || '';
-    if (existing && !PLACEHOLDERS.has(existing.toLowerCase())) {
-      continue;
-    }
-    toWrite[newKey] = value;
-    migrated.push(newKey);
-  }
+  log('⬇️', 'uv not found — installing...');
 
-  if (migrated.length === 0) {
-    log('ℹ️', 'Nothing to migrate — target already has all values.');
-    if (warnings.length > 0) {
-      log('⚠️', `Unknown keys in sdlc-config.env: ${warnings.join(', ')}`);
+  if (IS_WIN) {
+    try {
+      execSync(
+        'powershell -ExecutionPolicy Bypass -c "irm https://astral.sh/uv/install.ps1 | iex"',
+        { stdio: 'inherit' },
+      );
+    } catch {
+      console.error('  ✗ uv install via PowerShell failed');
+      process.exit(1);
     }
-    return;
-  }
-
-  // Backup existing .env
-  if (existsSync(CONFIG_FILE)) {
-    const ts = Math.floor(Date.now() / 1000);
-    const backup = join(VDS_DIR, `.env.bak.${ts}`);
-    writeFileSync(backup, readFileSync(CONFIG_FILE));
-    log('📋', `Backup: ${backup}`);
-  }
-
-  // Read existing content or start fresh
-  let lines = existsSync(CONFIG_FILE)
-    ? readFileSync(CONFIG_FILE, 'utf-8').split('\n')
-    : [];
-
-  // Update in-place where key exists with empty value
-  const updated = new Set();
-  lines = lines.map(line => {
-    const stripped = line.trim();
-    if (!stripped || stripped.startsWith('#')) return line;
-    const eq = stripped.indexOf('=');
-    if (eq <= 0) return line;
-    const key = stripped.slice(0, eq).trim();
-    if (key in toWrite) {
-      updated.add(key);
-      return `${key}=${toWrite[key]}`;
+  } else if (IS_MAC) {
+    try {
+      execSync('HOMEBREW_NO_AUTO_UPDATE=1 brew install uv', { stdio: 'inherit' });
+    } catch {
+      // Fallback to curl
+      try {
+        execSync('curl -LsSf https://astral.sh/uv/install.sh | sh', { stdio: 'inherit' });
+      } catch {
+        console.error('  ✗ uv install failed (tried brew and curl)');
+        process.exit(1);
+      }
     }
-    return line;
-  });
-
-  // Append remaining
-  const remaining = Object.entries(toWrite).filter(([k]) => !updated.has(k));
-  if (remaining.length > 0) {
-    if (lines.length > 0 && lines[lines.length - 1].trim() !== '') lines.push('');
-    lines.push('# --- Migrated from sdlc-config.env ---');
-    for (const [key, val] of remaining) {
-      lines.push(`${key}=${val}`);
+  } else {
+    try {
+      execSync('curl -LsSf https://astral.sh/uv/install.sh | sh', { stdio: 'inherit' });
+    } catch {
+      console.error('  ✗ uv install via curl failed');
+      process.exit(1);
     }
   }
 
-  // Atomic write
-  const tmp = join(VDS_DIR, '.env.tmp');
-  writeFileSync(tmp, lines.join('\n') + '\n');
-  if (process.platform !== 'win32') {
-    chmodSync(tmp, 0o600);
-  }
-  renameSync(tmp, CONFIG_FILE);
-
-  log('✅', `Migrated ${migrated.length} credential(s) from sdlc-config.env:`);
-  for (const name of migrated) {
-    log('  ', `+ ${name}`);
-  }
-  if (skipped.length > 0) {
-    log('ℹ️', `Skipped ${skipped.length} placeholder(s).`);
+  uv = resolveUv();
+  if (!uv) {
+    console.error('  ✗ uv not found after install — restart terminal or add to PATH');
+    process.exit(1);
   }
-  if (warnings.length > 0) {
-    log('⚠️', `Unknown keys (not migrated): ${warnings.join(', ')}`);
-  }
-  console.log('');
-  log('💡', `Consider removing ${LEGACY_CONFIG} to avoid confusion.`);
+  return uv;
 }
 
-// ── Step 0: Migrate legacy sdlc-config.env (if exists) ──
-
-console.log('\n[vds-skill] Setting up VDS credentials...\n');
-
-mkdirSync(VDS_DIR, { recursive: true });
+// ── 3. Copy runtime ──
 
-if (!skipMigration) {
-  migrateSdlcConfig();
-} else {
-  log('ℹ️', 'Migration skipped (--skip-migration).');
-}
-
-// ── Step 1: Create or merge credential template ──
-
-const existing = parseExistingConfig(CONFIG_FILE);
-const missing = [];
-const filled = [];
-
-for (const v of REQUIRED_VARS) {
-  if (existing[v.name]) {
-    filled.push(v);
-  } else {
-    missing.push(v);
-  }
-}
-
-if (!existsSync(CONFIG_FILE)) {
-  // Create fresh template
-  const lines = [
-    '# VDS shared environment — credential config',
-    '# File: ~/.vds/.env',
-    '# Permissions: 600 (auto-set by installer)',
-    '#',
-    '# Set per-service Personal Access Tokens (recommended):',
-    '#   INTERNAL_CONFLUENCE_TOKEN, JIRA_TOKEN, BITBUCKET_TOKEN',
-    '# Or basic auth fallback: VDS_USERNAME + VDS_PASSWORD (works for all services)',
-    '# To rotate a credential: update the value here, orchestrators pick it up next run.',
-    '',
-  ];
-
-  for (const v of REQUIRED_VARS) {
-    lines.push(`# ${v.desc}`);
-    lines.push(`# Used by: ${v.skills}`);
-    lines.push(`${v.name}=`);
-    lines.push('');
-  }
-
-  lines.push('# --- Basic auth fallback (optional, only if PATs not available) ---');
-  lines.push('');
-  for (const v of OPTIONAL_VARS) {
-    lines.push(`# ${v.desc}`);
-    lines.push(`# ${v.name}=`);
-  }
-  lines.push('');
-
-  writeFileSync(CONFIG_FILE, lines.join('\n'));
-  if (process.platform !== 'win32') {
-    chmodSync(CONFIG_FILE, 0o600);
-  }
-  log('✅', `Config created: ${CONFIG_FILE}`);
-} else if (missing.length > 0) {
-  // Append missing vars to existing config
-  const appendLines = ['\n# --- Added by vds-skill install ---\n'];
-  for (const v of missing) {
-    if (!readFileSync(CONFIG_FILE, 'utf-8').includes(v.name)) {
-      appendLines.push(`# ${v.desc}`);
-      appendLines.push(`# Used by: ${v.skills}`);
-      appendLines.push(`${v.name}=`);
-      appendLines.push('');
-    }
+function copyRuntime() {
+  const runtimeSrc = join(packDir, 'runtime');
+  if (existsSync(VDS_DIR) && !force) {
+    log('⊘', `vds-scripts already exists at ${VDS_DIR}`);
+    return;
   }
-  if (appendLines.length > 1) {
-    writeFileSync(CONFIG_FILE, readFileSync(CONFIG_FILE, 'utf-8') + appendLines.join('\n'));
-    if (process.platform !== 'win32') {
-      chmodSync(CONFIG_FILE, 0o600);
-    }
-    log('✅', `Config updated: ${CONFIG_FILE}`);
+  if (existsSync(VDS_DIR) && force) {
+    rmSync(VDS_DIR, { recursive: true, force: true });
   }
-} else {
-  log('✅', `Config already complete: ${CONFIG_FILE}`);
+  mkdirSync(VDS_DIR, { recursive: true });
+  cpSync(runtimeSrc, VDS_DIR, { recursive: true });
+  log('✓', `vds-scripts copied to ${VDS_DIR}`);
 }
 
-// ── Step 3: Print status ──
+// ── 4. uv sync ──
 
-console.log('');
-if (filled.length > 0) {
-  log('✅', `${filled.length} credential(s) already configured:`);
-  for (const v of filled) {
-    log('  ', `${v.name} — ${v.desc}`);
-  }
-}
-
-if (missing.length > 0) {
-  console.log('');
-  log('⚠️', `${missing.length} credential(s) need to be filled:`);
-  console.log('');
-  console.log('  ┌────────────────────────────────────┬──────────────────────────────────────────────┐');
-  console.log('  │ Variable                           │ Description                                  │');
-  console.log('  ├────────────────────────────────────┼──────────────────────────────────────────────┤');
-  for (const v of missing) {
-    const name = v.name.padEnd(36);
-    const desc = v.desc.padEnd(44);
-    console.log(`  │ ${name}│ ${desc}│`);
-  }
-  console.log('  └────────────────────────────────────┴──────────────────────────────────────────────┘');
-  console.log('');
-  log('📝', `Edit config file:`);
-  console.log(`       ${CONFIG_FILE}`);
-  console.log('');
-  log('💡', 'Skills will also lazy-prompt at runtime if values are empty.');
+function uvSync(uvCmd) {
+  execSync(`${uvCmd} sync`, { cwd: VDS_DIR, stdio: 'inherit' });
+  log('✓', 'uv sync completed');
 }
 
-// ── Step 4: Deploy bundled vds-scripts to project ──
+// ── 5. Provision .env ──
 
-console.log('');
-const { execSync } = await import('child_process');
+const ENV_TEMPLATE = `# VDS Environment Configuration
+# Fill in your credentials below
+# Location: ~/.vds/.env
 
-const localVdsScripts = join(projectPath, '.claude', 'vds-scripts');
-const globalVdsScripts = join(homedir(), '.claude', 'vds-scripts');
-const bundledVdsScripts = join(packDir, 'vds-scripts');
+# ── Authentication ──
+VDS_USERNAME=
+VDS_PASSWORD=
 
-if (!existsSync(localVdsScripts) && existsSync(bundledVdsScripts)) {
-  log('📦', 'Deploying bundled vds-scripts to .claude/vds-scripts/ ...');
-  try {
-    mkdirSync(join(projectPath, '.claude'), { recursive: true });
-    cpSync(bundledVdsScripts, localVdsScripts, { recursive: true });
-    log('✅', `vds-scripts deployed: ${localVdsScripts}`);
-  } catch (e) {
-    log('⚠️', `Failed to deploy vds-scripts: ${e.message}`);
-  }
-} else if (existsSync(localVdsScripts)) {
-  log('✅', 'vds-scripts already exists at .claude/vds-scripts/');
-}
+# ── Bitbucket ──
+BITBUCKET_ACCESS_TOKEN=
+VDS_BITBUCKET_URL=
 
-// Detect vds-scripts location (project-local preferred, then global)
-const vdsScriptsDir = existsSync(localVdsScripts) ? localVdsScripts
-  : existsSync(globalVdsScripts) ? globalVdsScripts
-  : null;
+# ── Confluence ──
+INTERNAL_CONFLUENCE_TOKEN=
+EXTERNAL_CONFLUENCE_TOKEN=
 
-let vdsCliFound = false;
+# ── Git ──
+VDS_GIT_PROJECTS=
+VDS_GIT_CONCURRENCY_DEFAULT=8
 
-// Check if vds-cli is already on PATH
-try {
-  const version = execSync('vds-cli version', { stdio: 'pipe', encoding: 'utf-8' }).trim();
-  log('✅', `vds-cli ${version} (on PATH)`);
-  vdsCliFound = true;
-} catch {
-  // Not on PATH — try to create project-local wrapper
-}
-
-// Create project-local vds-cli wrapper if vds-scripts exists but vds-cli not on PATH
-if (!vdsCliFound && vdsScriptsDir) {
-  const wrapperDir = join(projectPath, '.claude', 'bin');
-  const wrapperPath = join(wrapperDir, 'vds-cli');
-  // Check vds-scripts has valid structure (pyproject.toml = uv project)
-  if (existsSync(join(vdsScriptsDir, 'pyproject.toml'))) {
-    mkdirSync(wrapperDir, { recursive: true });
-
-    if (process.platform === 'win32') {
-      // Windows: Node.js wrapper + .cmd shim
-      const wrapperContent = `#!/usr/bin/env node
-// Project-local vds-cli wrapper — created by vsaf install vds-skill
-const { execFileSync } = require('child_process');
-try {
-  execFileSync('uv', ['run', '--directory', ${JSON.stringify(vdsScriptsDir)}, '--package', 'vds-cli', 'vds-cli', ...process.argv.slice(2)], { stdio: 'inherit', shell: true });
-} catch (e) {
-  process.exit(e.status || 1);
-}
-`;
-      writeFileSync(wrapperPath, wrapperContent);
-      writeFileSync(wrapperPath + '.cmd', `@node "%~dp0\\vds-cli" %*\r\n`);
-    } else {
-      // Unix: pure bash wrapper — no node/nvm dependency
-      const wrapperContent = `#!/usr/bin/env bash
-# Project-local vds-cli wrapper — created by vsaf install vds-skill
-# Uses bash instead of node to avoid nvm/node PATH issues
-exec uv run --directory ${JSON.stringify(vdsScriptsDir)} --package vds-cli vds-cli "$@"
+# ── Optional ──
+# VDS_GIT_HTTP_TIMEOUT=300
+# VDS_GIT_RETRIES=2
+# VDS_GIT_BACKOFF=1.5
+# VDS_GIT_HTTP_POST_BUFFER=524288000
+# VDS_GIT_HTTP_LOW_SPEED_LIMIT=1000
+# VDS_GIT_HTTP_LOW_SPEED_TIME=300
+# VDS_GIT_AUTO_REGENERATE_MANIFEST=
+# BITBUCKET_TOKEN=
 `;
-      writeFileSync(wrapperPath, wrapperContent);
-      chmodSync(wrapperPath, 0o755);
-    }
-    log('✅', `vds-cli wrapper created: ${wrapperPath}`);
-    log('  ', `Points to: ${vdsScriptsDir}`);
-
-    // Auto-register .claude/bin in CLAUDE.md so Claude Code always finds vds-cli
-    const claudeMdPath = join(projectPath, 'CLAUDE.md');
-    try {
-      const content = existsSync(claudeMdPath) ? readFileSync(claudeMdPath, 'utf-8') : '';
-      const pathExport = 'export PATH=".claude/bin:$PATH"';
-      if (!content.includes('.claude/bin')) {
-        const block = `\n\n## vds-cli PATH\n\nBefore running any \`vds-cli\` command, prepend the local bin directory:\n\`\`\`bash\n${pathExport}\n\`\`\`\nOr use the full path: \`.claude/bin/vds-cli\`\n`;
-        writeFileSync(claudeMdPath, content + block);
-        log('✅', 'PATH hint added to CLAUDE.md');
-      }
-    } catch {
-      // CLAUDE.md update is best-effort
-    }
-
-    // Also add Bash permission for .claude/bin/vds-cli in settings.local.json
-    const settingsPath = join(projectPath, '.claude', 'settings.local.json');
-    try {
-      const settings = existsSync(settingsPath)
-        ? JSON.parse(readFileSync(settingsPath, 'utf-8'))
-        : {};
-      if (!settings.permissions) settings.permissions = {};
-      if (!settings.permissions.allow) settings.permissions.allow = [];
-      const vdsRule = 'Bash(.claude/bin/vds-cli *)';
-      if (!settings.permissions.allow.some(r => r.includes('.claude/bin/vds-cli'))) {
-        settings.permissions.allow.push(vdsRule);
-        writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
-        log('✅', 'vds-cli permission added to settings.local.json');
-      }
-    } catch {
-      // settings update is best-effort
-    }
-
-    vdsCliFound = true;
-  }
-}
-
-if (!vdsCliFound) {
-  log('⚠️', 'vds-cli not found — required for non-dry-run execution');
-  log('  ', 'Option 1: Clone vds-scripts into .claude/vds-scripts/ then re-run install');
-  log('  ', 'Option 2: Install vds-cli globally (pip install / Viettel internal)');
-  log('  ', 'Verify:   vds-cli version');
-}
-
-// ── Step 5: Sync all vds-scripts packages (ensures subcommand binaries exist) ──
-
-if (vdsScriptsDir) {
-  log('📂', `vds-scripts: ${vdsScriptsDir}`);
-  if (existsSync(join(vdsScriptsDir, 'pyproject.toml'))) {
-    // Check uv is available before attempting sync
-    let uvAvailable = false;
-    try {
-      execSync('uv --version', { stdio: 'pipe', encoding: 'utf-8', timeout: 10000 });
-      uvAvailable = true;
-    } catch {
-      log('⚠️', 'uv (Python package manager) not found — required for vds-scripts');
-      if (process.platform === 'win32') {
-        log('  ', 'Install: powershell -c "irm https://astral.sh/uv/install.ps1 | iex"');
-        log('  ', '  or:    winget install astral-sh.uv');
-      } else {
-        log('  ', 'Install: curl -LsSf https://astral.sh/uv/install.sh | sh');
-        log('  ', '  or:    brew install uv');
-      }
-    }
 
-    if (uvAvailable) {
-      console.log('');
-      log('🔄', 'Syncing vds-scripts packages (uv sync --all-packages)...');
-      try {
-        execSync('uv sync --all-packages', {
-          stdio: 'pipe',
-          encoding: 'utf-8',
-          timeout: 600000,
-          cwd: vdsScriptsDir,
-          env: { ...process.env, UV_HTTP_TIMEOUT: '300' },
-        });
-        log('✅', 'All vds-scripts packages synced');
-      } catch (e) {
-        log('⚠️', 'Failed to sync vds-scripts packages — subcommands like confluence/jira may not work');
-        if (e.stderr) log('  ', `Error: ${e.stderr.trim().split('\n')[0]}`);
-        log('  ', `Fix: cd ${vdsScriptsDir} && uv sync --all-packages`);
-      }
-    }
+function provisionEnv() {
+  if (existsSync(ENV_FILE)) {
+    log('⊘', `.env already exists at ${ENV_FILE}`);
+    return;
   }
-} else {
-  log('⚠️', 'vds-scripts not found at .claude/vds-scripts/ or ~/.claude/vds-scripts/');
+  mkdirSync(ENV_DIR, { recursive: true });
+  writeFileSync(ENV_FILE, ENV_TEMPLATE, 'utf-8');
+  log('✓', `.env template created at ${ENV_FILE}`);
+  log('⚠', `Fill in your credentials: ${ENV_FILE}`);
 }
 
-// ── Step 6: Verify vds-cli actually works (catch broken shims) ──
+// ── Main ──
 
-console.log('');
-log('🔍', 'Verifying vds-cli...');
+console.log('\n[vds-skill] Checking Python...');
+const pyVer = checkPython();
+log('✓', `Python ${pyVer}`);
 
-let verified = false;
+console.log('[vds-skill] Ensuring uv...');
+const uvCmd = ensureUv();
+log('✓', 'uv ready');
 
-// First pass: try vds-cli on PATH
-try {
-  const ver = execSync('vds-cli version', { stdio: 'pipe', encoding: 'utf-8', timeout: 60000 }).trim();
-  log('✅', `vds-cli ${ver} — working`);
-  verified = true;
-} catch {
-  // vds-cli on PATH failed — check if a broken shim exists and auto-remove it
-  try {
-    const whichCmd = process.platform === 'win32' ? 'where' : 'which';
-    const shimPath = execSync(`${whichCmd} vds-cli`, { stdio: 'pipe', encoding: 'utf-8' }).trim().split('\n')[0];
-    // Shim exists but doesn't work — remove it automatically
-    log('🗑️', `Removing broken shim: ${shimPath}`);
-    try {
-      unlinkSync(shimPath);
-      log('✅', 'Broken shim removed');
-    } catch (e) {
-      log('⚠️', `Cannot auto-remove shim (${e.code || e.message})`);
-      if (process.platform === 'win32') {
-        log('  ', 'Fix: open cmd as Administrator, then run:');
-        log('  ', `  del "${shimPath}"`);
-        log('  ', '  vsaf install vds-skill');
-      } else {
-        log('  ', `Fix: rm "${shimPath}"  then re-run: vsaf install vds-skill`);
-      }
-    }
-  } catch {
-    // No shim found — that's fine
-  }
-}
+console.log('[vds-skill] Setting up vds-scripts runtime...');
+copyRuntime();
 
-// Second pass: try project-local wrapper
-if (!verified) {
-  try {
-    const wrapperPath = join(projectPath, '.claude', 'bin');
-    const ver = execSync('vds-cli version', {
-      stdio: 'pipe', encoding: 'utf-8', timeout: 60000,
-      env: { ...process.env, PATH: `${wrapperPath}${delimiter}${process.env.PATH}` },
-    }).trim();
-    log('✅', `vds-cli ${ver} — working (via .claude/bin/vds-cli)`);
-    verified = true;
-  } catch (e) {
-    log('❌', 'vds-cli not working — skills will be BLOCKED at runtime');
-    if (e.stderr) log('  ', `stderr: ${e.stderr.toString().trim().split('\n').slice(0, 3).join('\n         ')}`);
-    else log('  ', `Error: ${e.message || e}`);
-
-    // Diagnostic: test uv run directly to isolate the issue
-    if (vdsScriptsDir) {
-      try {
-        const uvVer = execSync(`uv run --directory ${JSON.stringify(vdsScriptsDir)} --package vds-cli vds-cli version`, {
-          stdio: 'pipe', encoding: 'utf-8', timeout: 60000,
-        }).trim();
-        log('  ', `Direct uv run works: ${uvVer}`);
-        log('  ', 'Issue is with the wrapper script, not uv/vds-cli');
-      } catch (uvErr) {
-        log('  ', `Direct uv run also fails: ${uvErr.stderr ? uvErr.stderr.toString().trim().split('\n')[0] : uvErr.message}`);
-      }
-    }
-  }
-}
+console.log('[vds-skill] Running uv sync...');
+uvSync(uvCmd);
 
-// ── Step 7: Print verification commands for user ──
-
-console.log('');
-console.log('  ┌──────────────────────────────────────────────────────┐');
-console.log('  │  Verify commands (run these to confirm setup):       │');
-console.log('  ├──────────────────────────────────────────────────────┤');
-console.log('  │  vds-cli version            # CLI is executable     │');
-console.log('  │  vds-cli confluence --help   # Confluence subcommand │');
-console.log('  │  vds-cli jira --help         # Jira subcommand      │');
-console.log('  │  vds-cli bitbucket --help    # Bitbucket subcommand │');
-console.log('  └──────────────────────────────────────────────────────┘');
-
-if (!verified) {
-  console.log('');
-  log('⚠️', 'vds-cli is NOT working — skills will be BLOCKED at runtime.');
-  log('  ', 'Fix vds-cli first, then run the verify commands above.');
-}
+console.log('[vds-skill] Provisioning .env...');
+provisionEnv();
 
 console.log('\n[vds-skill] Setup complete ✅\n');