@pleri/olam-cli 0.1.145 → 0.1.146

package/dist/commands/skills-migrate.js

@@ -0,0 +1,216 @@
+/**
+ * `olam skills migrate-from-toolbox` — convert an existing toolbox-shaped
+ * skill source (e.g. atlas-toolbox, grain/ai-skills) installation to
+ * olam-managed skill distribution.
+ *
+ * Order of operations (atomic in spirit — snapshot first, mutations after):
+ *   1. detectToolboxState({ toolboxPath }) → MigrationSnapshot (or no-op when nothing detected)
+ *   2. writeMigrationSnapshot() → ~/.olam/state/migration-snapshots/<namespace>-<ISO>.json
+ *   3. addSkillSource() + cloneSkillSource() → register the toolbox as an olam source
+ *   4. uninstall legacy toolbox SessionStart hook entries (entries whose command
+ *      references the toolbox repo path OR `./scripts/sync.sh`)
+ *   5. install the olam-skills SessionStart hook (via mergeHomeSettingsJson)
+ *   6. run `olam skills sync` to deploy artifacts under olam management
+ *
+ * Idempotent: re-running on an already-migrated host detects the olam
+ * hook sentinel and no-ops with an informative message.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { addSkillSource, cloneSkillSource, detectToolboxState, writeMigrationSnapshot, OLAM_SKILLS_HOOK_SENTINEL, buildSkillsHookEntry, OLAM_SKILLS_HOOK_STAGE, syncSkills, } from '@olam/core/src/skill-sources/index.js';
+import { mergeHomeSettingsJson } from '@olam/core/src/world/merge-settings.js';
+import { claudeSettingsPath } from '@olam/core/src/skill-sources/index.js';
+import { printError, printInfo, printSuccess, printWarning } from '../output.js';
+/** Stable command identifier — referenced by tests to keep them rename-resilient. */
+export const MIGRATE_FROM_TOOLBOX_COMMAND = 'migrate-from-toolbox';
+function asMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function isOlamSkillsHookPresent(filePath) {
+    if (!fs.existsSync(filePath))
+        return false;
+    try {
+        const raw = fs.readFileSync(filePath, 'utf-8');
+        return raw.includes(OLAM_SKILLS_HOOK_SENTINEL);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Surgically remove SessionStart hook entries that reference the toolbox
+ * repo path OR call `./scripts/sync.sh` (legacy atlas-toolbox sync entry —
+ * harmless no-op against non-atlas toolboxes). Leaves olam-skills entries
+ * and unrelated user hooks intact.
+ */
+function uninstallLegacyToolboxSessionStartHook(filePath, toolboxPath) {
+    if (!fs.existsSync(filePath))
+        return { removed: 0 };
+    const raw = fs.readFileSync(filePath, 'utf-8');
+    const settings = raw.trim() ? JSON.parse(raw) : {};
+    const ss = settings?.hooks?.SessionStart;
+    if (!Array.isArray(ss))
+        return { removed: 0 };
+    let removed = 0;
+    const filteredMatchers = [];
+    for (const matcher of ss) {
+        const innerHooks = Array.isArray(matcher?.hooks) ? matcher.hooks : [];
+        const keptInner = innerHooks.filter((h) => {
+            if (typeof h?.command !== 'string')
+                return true;
+            // Identify legacy-toolbox-shape entries by command content.
+            const looksLegacyToolbox = h.command.includes('./scripts/sync.sh') ||
+                (toolboxPath !== undefined && h.command.includes(toolboxPath));
+            // Never remove olam-skills entries here — install-skills-hook handles those.
+            const isOlam = h.command.includes(OLAM_SKILLS_HOOK_SENTINEL);
+            if (looksLegacyToolbox && !isOlam) {
+                removed += 1;
+                return false;
+            }
+            return true;
+        });
+        if (keptInner.length === 0 && innerHooks.length > 0)
+            continue;
+        if (keptInner.length === innerHooks.length)
+            filteredMatchers.push(matcher);
+        else
+            filteredMatchers.push({ ...matcher, hooks: keptInner });
+    }
+    if (removed === 0)
+        return { removed: 0 };
+    const next = { ...settings, hooks: { ...settings.hooks, SessionStart: filteredMatchers } };
+    if (filteredMatchers.length === 0) {
+        const otherStages = Object.keys(next.hooks ?? {}).filter((k) => k !== 'SessionStart');
+        if (otherStages.length === 0)
+            delete next.hooks;
+        else
+            delete next.hooks.SessionStart;
+    }
+    fs.writeFileSync(filePath, JSON.stringify(next, null, 2) + '\n');
+    return { removed };
+}
+export function registerSkillsMigrate(program) {
+    const skills = program.commands.find((c) => c.name() === 'skills') ??
+        program.command('skills').description('Manage skill sources and synchronization');
+    skills
+        .command(MIGRATE_FROM_TOOLBOX_COMMAND)
+        .description('Convert an existing toolbox-shaped skill source (atlas-toolbox, grain/ai-skills, etc.) to olam-managed skill distribution')
+        .option('--path <path>', 'Absolute path to the source toolbox repo (e.g. /repos/atlas-toolbox, /repos/grain/ai-skills)')
+        .option('--namespace <name>', 'Source-identifying namespace used for the snapshot filename + default source name (default: basename of --path)')
+        .option('--source-name <name>', 'Display name for the registered olam source (default: --namespace)')
+        .option('--branch <branch>', 'Branch to track on the source', 'master')
+        .option('--scope <scope>', 'install-hook scope: project (default) or user', 'project')
+        .option('--no-clone', 'Skip clone step (register source state only — useful for tests)')
+        .action(async (opts) => {
+        // Idempotency: if olam-skills sentinel already present, no-op.
+        const settingsFile = claudeSettingsPath();
+        if (isOlamSkillsHookPresent(settingsFile)) {
+            printInfo(MIGRATE_FROM_TOOLBOX_COMMAND, `already migrated (olam-skills hook sentinel present in ${settingsFile})`);
+            return;
+        }
+        if (!opts.path) {
+            printError('--path <path> is required (absolute path to the source toolbox repo, e.g. /repos/atlas-toolbox)');
+            process.exitCode = 1;
+            return;
+        }
+        const toolboxPath = opts.path;
+        const namespace = opts.namespace ?? path.basename(toolboxPath);
+        const sourceName = opts.sourceName ?? namespace;
+        // 1. Detect.
+        const snapshot = detectToolboxState({ toolboxPath, namespace });
+        if (!snapshot) {
+            printInfo(MIGRATE_FROM_TOOLBOX_COMMAND, `no toolbox state detected at ${toolboxPath} (no ~/.claude/.atlas-user, no symlinks pointing at this path, no SessionStart hook block — nothing to migrate)`);
+            return;
+        }
+        // 2. Snapshot (ALWAYS — before any mutation).
+        let snapshotPath;
+        try {
+            snapshotPath = writeMigrationSnapshot(snapshot);
+            printInfo('snapshot', snapshotPath);
+        }
+        catch (err) {
+            printError(`snapshot write failed: ${asMessage(err)}`);
+            process.exitCode = 1;
+            return;
+        }
+        // 3. Register source + clone.
+        // `trustMethod: 'internal'` — migrate-from is an operator-explicit
+        // command (operator typed it). Bypasses the interactive trust
+        // gate but is structurally audit-logged via addSkillSource()
+        // itself; the trust-audit log records the bypass.
+        try {
+            const entry = addSkillSource({
+                name: sourceName,
+                gitUrl: toolboxPath,
+                branch: opts.branch,
+                trustMethod: 'internal',
+            });
+            printInfo('registered source', `${entry.name} (${entry.id})`);
+            if (opts.clone !== false) {
+                const cloneResult = cloneSkillSource({
+                    gitUrl: entry.gitUrl,
+                    branch: entry.branch,
+                    id: entry.id,
+                });
+                printInfo('cloned to', cloneResult.clonePath);
+            }
+            else {
+                printInfo('clone skipped', '--no-clone passed');
+            }
+        }
+        catch (err) {
+            printError(`source registration failed: ${asMessage(err)}`);
+            printInfo('snapshot preserved', snapshotPath);
+            process.exitCode = 1;
+            return;
+        }
+        // 4. Uninstall legacy toolbox SessionStart hook.
+        try {
+            const surgery = uninstallLegacyToolboxSessionStartHook(settingsFile, toolboxPath);
+            if (surgery.removed > 0) {
+                printInfo('legacy hook', `removed ${surgery.removed} entry(ies) from ${settingsFile}`);
+            }
+            else {
+                printInfo('legacy hook', 'no legacy-toolbox-shape SessionStart hook entries found');
+            }
+        }
+        catch (err) {
+            printWarning(`legacy hook removal failed: ${asMessage(err)}; proceeding`);
+        }
+        // 5. Install olam-skills hook.
+        const scope = opts.scope === 'user' ? 'user' : 'project';
+        const olamHookPath = scope === 'user' ? settingsFile : path.join(process.cwd(), '.claude', 'settings.json');
+        try {
+            fs.mkdirSync(path.dirname(olamHookPath), { recursive: true });
+            const result = mergeHomeSettingsJson(olamHookPath, {
+                ensureHook: {
+                    stage: OLAM_SKILLS_HOOK_STAGE,
+                    sentinel: OLAM_SKILLS_HOOK_SENTINEL,
+                    entry: buildSkillsHookEntry(),
+                },
+            });
+            printInfo('olam hook', `${result.status} at ${olamHookPath}`);
+        }
+        catch (err) {
+            printError(`olam hook install failed: ${asMessage(err)}`);
+            printInfo('snapshot preserved', snapshotPath);
+            process.exitCode = 1;
+            return;
+        }
+        // 6. Sync.
+        try {
+            const summary = await syncSkills({ atlasUser: snapshot.atlasUser });
+            printSuccess(`migrated — synced ${summary.sourceCount} source(s), deployed ${summary.deploy?.linked ?? 0} symlink(s)`);
+            printInfo('snapshot', snapshotPath);
+            printInfo('reverse', `run \`olam skills migrate-back-to-toolbox --path ${toolboxPath}\` to restore the original state`);
+        }
+        catch (err) {
+            printError(`sync failed: ${asMessage(err)}`);
+            printInfo('snapshot preserved', snapshotPath);
+            process.exitCode = 1;
+        }
+    });
+}
+// Export internal helper for tests + reverse-migration consumers.
+export { uninstallLegacyToolboxSessionStartHook };
+//# sourceMappingURL=skills-migrate.js.map

package/dist/commands/skills-migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-migrate.js","sourceRoot":"","sources":["../../src/commands/skills-migrate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,sBAAsB,EACtB,UAAU,GACX,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjF,qFAAqF;AACrF,MAAM,CAAC,MAAM,4BAA4B,GAAG,sBAAsB,CAAC;AAEnE,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,GAAG,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAMD;;;;;GAKG;AACH,SAAS,sCAAsC,CAC7C,QAAgB,EAChB,WAA+B;IAE/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACpD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,MAAM,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAE9C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,gBAAgB,GAAG,EAAE,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,EAAE,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAuB,EAAE,EAAE;YAC9D,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAChD,4DAA4D;YAC5D,MAAM,kBAAkB,GACtB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBACvC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACjE,6EAA6E;YAC7E,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;YAC7D,IAAI,kBAAkB,IAAI,CAAC,MAAM,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC,CAAC;gBACb,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC9D,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;;YACtE,gBAAgB,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAAE,CAAC;IAC3F,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;QACtF,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;;YAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;IACtC,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjE,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,MAAM,GACV,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC;QACnD,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;IAEpF,MAAM;SACH,OAAO,CAAC,4BAA4B,CAAC;SACrC,WAAW,CAAC,2HAA2H,CAAC;SACxI,MAAM,CACL,eAAe,EACf,8FAA8F,CAC/F;SACA,MAAM,CACL,oBAAoB,EACpB,iHAAiH,CAClH;SACA,MAAM,CAAC,sBAAsB,EAAE,oEAAoE,CAAC;SACpG,MAAM,CAAC,mBAAmB,EAAE,+BAA+B,EAAE,QAAQ,CAAC;SACtE,MAAM,CAAC,iBAAiB,EAAE,+CAA+C,EAAE,SAAS,CAAC;SACrF,MAAM,CAAC,YAAY,EAAE,iEAAiE,CAAC;SACvF,MAAM,CAAC,KAAK,EAAE,IAOd,EAAE,EAAE;QACH,+DAA+D;QAC/D,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAC;QAC1C,IAAI,uBAAuB,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1C,SAAS,CAAC,4BAA4B,EAAE,0DAA0D,YAAY,GAAG,CAAC,CAAC;YACnH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,UAAU,CAAC,iGAAiG,CAAC,CAAC;YAC9G,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC;QAEhD,aAAa;QACb,MAAM,QAAQ,GAAG,kBAAkB,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,SAAS,CACP,4BAA4B,EAC5B,gCAAgC,WAAW,iHAAiH,CAC7J,CAAC;YACF,OAAO;QACT,CAAC;QAED,8CAA8C;QAC9C,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,YAAY,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YAChD,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,0BAA0B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,8BAA8B;QAC9B,mEAAmE;QACnE,8DAA8D;QAC9D,6DAA6D;QAC7D,kDAAkD;QAClD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,cAAc,CAAC;gBAC3B,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,UAAU;aACxB,CAAC,CAAC;YACH,SAAS,CAAC,mBAAmB,EAAE,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9D,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBACzB,MAAM,WAAW,GAAG,gBAAgB,CAAC;oBACnC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,EAAE,EAAE,KAAK,CAAC,EAAE;iBACb,CAAC,CAAC;gBACH,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,+BAA+B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC5D,SAAS,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;YAC9C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,sCAAsC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAClF,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;gBACxB,SAAS,CAAC,aAAa,EAAE,WAAW,OAAO,CAAC,OAAO,oBAAoB,YAAY,EAAE,CAAC,CAAC;YACzF,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,aAAa,EAAE,yDAAyD,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,+BAA+B,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5E,CAAC;QAED,+BAA+B;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACzD,MAAM,YAAY,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAC5G,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,qBAAqB,CAAC,YAAY,EAAE;gBACjD,UAAU,EAAE;oBACV,KAAK,EAAE,sBAAsB;oBAC7B,QAAQ,EAAE,yBAAyB;oBACnC,KAAK,EAAE,oBAAoB,EAAwC;iBACpE;aACF,CAAC,CAAC;YACH,SAAS,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,MAAM,OAAO,YAAY,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,6BAA6B,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1D,SAAS,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;YAC9C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,WAAW;QACX,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACpE,YAAY,CACV,qBAAqB,OAAO,CAAC,WAAW,wBAAwB,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,aAAa,CACzG,CAAC;YACF,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACpC,SAAS,CAAC,SAAS,EAAE,oDAAoD,WAAW,kCAAkC,CAAC,CAAC;QAC1H,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,CAAC,gBAAgB,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7C,SAAS,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;YAC9C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,kEAAkE;AAClE,OAAO,EAAE,sCAAsC,EAAE,CAAC"}

package/dist/commands/skills-onboard.d.ts

@@ -0,0 +1,26 @@
+/**
+ * olam skills onboard — fresh-install umbrella that composes the 3-step
+ * recipe into one operator-friendly verb.
+ *
+ *   olam skills onboard --name <n> --git-url <url> [--branch main]
+ *                       [--trust] [--scope project|user]
+ *
+ * Pipeline:
+ *   1. addSkillSource({ trustMethod: 'flag' }) — `--trust` is the only
+ *      sanctioned trust method here. Onboard is non-interactive by
+ *      design (it composes 4 steps; an interactive picker mid-pipeline
+ *      would be confusing). Operators who want the picker should run
+ *      `olam skills source add` directly.
+ *   2. cloneSkillSource(...) — register + clone.
+ *   3. installSkillsHookToFile(...) at --scope (default project).
+ *   4. syncSkills() — first sync.
+ *   5. Print a single success summary covering all 4 steps.
+ *
+ * Failure rollback: any failure AFTER step 1 (clone, hook install,
+ * sync) unwinds the registered source so the operator can re-try
+ * cleanly. Each step appends an audit row so the trust-coverage gate
+ * stays accurate even when the umbrella partially fails.
+ */
+import type { Command } from 'commander';
+export declare function registerSkillsOnboard(program: Command): void;
+//# sourceMappingURL=skills-onboard.d.ts.map

package/dist/commands/skills-onboard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-onboard.d.ts","sourceRoot":"","sources":["../../src/commands/skills-onboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6BzC,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA0M5D"}

package/dist/commands/skills-onboard.js

@@ -0,0 +1,227 @@
+/**
+ * olam skills onboard — fresh-install umbrella that composes the 3-step
+ * recipe into one operator-friendly verb.
+ *
+ *   olam skills onboard --name <n> --git-url <url> [--branch main]
+ *                       [--trust] [--scope project|user]
+ *
+ * Pipeline:
+ *   1. addSkillSource({ trustMethod: 'flag' }) — `--trust` is the only
+ *      sanctioned trust method here. Onboard is non-interactive by
+ *      design (it composes 4 steps; an interactive picker mid-pipeline
+ *      would be confusing). Operators who want the picker should run
+ *      `olam skills source add` directly.
+ *   2. cloneSkillSource(...) — register + clone.
+ *   3. installSkillsHookToFile(...) at --scope (default project).
+ *   4. syncSkills() — first sync.
+ *   5. Print a single success summary covering all 4 steps.
+ *
+ * Failure rollback: any failure AFTER step 1 (clone, hook install,
+ * sync) unwinds the registered source so the operator can re-try
+ * cleanly. Each step appends an audit row so the trust-coverage gate
+ * stays accurate even when the umbrella partially fails.
+ */
+import pc from 'picocolors';
+import { addSkillSource, cloneSkillSource, installSkillsHookToFile, removeSkillSource, removeSkillSourceClone, skillsHookSettingsPathFor, syncSkills, updateSkillSource, appendTrustAudit, redactUrl, } from '@olam/core/src/skill-sources/index.js';
+import { printError, printInfo, printSuccess, printHeader } from '../output.js';
+function asMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+export function registerSkillsOnboard(program) {
+    const skills = program.commands.find((c) => c.name() === 'skills') ??
+        program.command('skills').description('Manage skill sources and synchronization');
+    skills
+        .command('onboard')
+        .description('Fresh-install umbrella: register + clone + install SessionStart hook + first sync, in one verb')
+        .requiredOption('--name <name>', 'Display name (lowercase, digits, dash)')
+        .requiredOption('--git-url <url>', 'git URL (https://, git@, ssh://, file://, or absolute path)')
+        .option('--branch <branch>', 'Branch to track', 'main')
+        .option('--trust', 'Acknowledge that registering grants symlink-into-~/.claude permission (required: onboard is non-interactive)')
+        .option('--scope <scope>', 'Hook install scope: project (<cwd>/.claude/settings.json) or user (~/.claude/settings.json)', 'project')
+        .action(async (opts) => {
+        const scope = opts.scope === 'user' ? 'user' : 'project';
+        // Onboard composes 4 steps end-to-end. Surfacing a TTY trust prompt
+        // mid-pipeline would split operator attention; require --trust as
+        // the only sanctioned path here. Operators who want the picker can
+        // run `olam skills source add` (then run install-hook + sync
+        // themselves) — same surface, different ergonomic.
+        if (opts.trust !== true) {
+            try {
+                appendTrustAudit({
+                    gitUrl: redactUrl(opts.gitUrl),
+                    action: 'auto-rejected',
+                    trustMethod: 'auto-reject-tty',
+                    note: 'onboard: --trust required (composed pipeline; no mid-flow picker)',
+                });
+            }
+            catch {
+                // best-effort audit
+            }
+            printError('`olam skills onboard` requires --trust. Registering a skill source grants ' +
+                'symlink-into-~/.claude permission; onboard is non-interactive so the operator ' +
+                'must acknowledge up front. (For the interactive picker use `olam skills source add`.)');
+            process.exitCode = 1;
+            return;
+        }
+        // ---------------------------------------------------------------
+        // Step 1: register the source (writes 'added' audit entry internally).
+        // ---------------------------------------------------------------
+        let entry;
+        try {
+            entry = addSkillSource({
+                name: opts.name,
+                gitUrl: opts.gitUrl,
+                branch: opts.branch ?? 'main',
+                trustMethod: 'flag',
+            });
+        }
+        catch (err) {
+            try {
+                appendTrustAudit({
+                    gitUrl: redactUrl(opts.gitUrl),
+                    action: 'failed',
+                    trustMethod: 'flag',
+                    note: `onboard step=add: ${asMessage(err)}`,
+                });
+            }
+            catch {
+                // best-effort
+            }
+            printError(asMessage(err));
+            process.exitCode = 1;
+            return;
+        }
+        // ---------------------------------------------------------------
+        // Step 2: clone the source. Rolls back step 1 on failure.
+        // ---------------------------------------------------------------
+        let headSha;
+        try {
+            const result = cloneSkillSource({
+                gitUrl: entry.gitUrl,
+                branch: entry.branch,
+                id: entry.id,
+            });
+            headSha = result.headSha;
+            updateSkillSource(entry.id, { lastPulledSha: result.headSha });
+        }
+        catch (err) {
+            try {
+                removeSkillSource(entry.id);
+            }
+            catch {
+                // best-effort
+            }
+            try {
+                appendTrustAudit({
+                    gitUrl: redactUrl(entry.gitUrl),
+                    action: 'failed',
+                    trustMethod: 'flag',
+                    sourceId: entry.id,
+                    note: `onboard step=clone: ${asMessage(err)}`,
+                });
+            }
+            catch {
+                // best-effort
+            }
+            printError(asMessage(err));
+            process.exitCode = 1;
+            return;
+        }
+        // ---------------------------------------------------------------
+        // Step 3: install SessionStart hook. Rolls back clone + register
+        // on failure so the operator's state stays clean.
+        // ---------------------------------------------------------------
+        const hookFilePath = skillsHookSettingsPathFor(scope);
+        let hookStatus;
+        let hookBackupPath;
+        try {
+            const result = installSkillsHookToFile(hookFilePath);
+            hookStatus = result.status;
+            hookBackupPath = result.backupPath;
+        }
+        catch (err) {
+            try {
+                removeSkillSourceClone(entry.id);
+                removeSkillSource(entry.id);
+            }
+            catch {
+                // best-effort
+            }
+            try {
+                appendTrustAudit({
+                    gitUrl: redactUrl(entry.gitUrl),
+                    action: 'failed',
+                    trustMethod: 'flag',
+                    sourceId: entry.id,
+                    note: `onboard step=install-hook: ${asMessage(err)}`,
+                });
+            }
+            catch {
+                // best-effort
+            }
+            printError(`install-hook failed: ${asMessage(err)}`);
+            process.exitCode = 1;
+            return;
+        }
+        // ---------------------------------------------------------------
+        // Step 4: first sync. Rolls back clone + register on failure so
+        // the operator can re-try cleanly. Leaves the hook in place — the
+        // hook is independently useful even if THIS source failed to
+        // deploy artifacts; uninstall-hook is its own surgical action.
+        // ---------------------------------------------------------------
+        let syncedArtifacts = 0;
+        try {
+            const summary = await syncSkills({});
+            syncedArtifacts = summary.artifactCount;
+        }
+        catch (err) {
+            try {
+                removeSkillSourceClone(entry.id);
+                removeSkillSource(entry.id);
+            }
+            catch {
+                // best-effort
+            }
+            try {
+                appendTrustAudit({
+                    gitUrl: redactUrl(entry.gitUrl),
+                    action: 'failed',
+                    trustMethod: 'flag',
+                    sourceId: entry.id,
+                    note: `onboard step=sync: ${asMessage(err)}`,
+                });
+            }
+            catch {
+                // best-effort
+            }
+            printError(`sync failed: ${asMessage(err)}`);
+            process.exitCode = 1;
+            return;
+        }
+        // ---------------------------------------------------------------
+        // Single success summary covering all 4 steps.
+        // ---------------------------------------------------------------
+        printHeader('skills onboard — complete');
+        printSuccess(`registered "${entry.name}" (${entry.id}) @ ${headSha.slice(0, 8)}`);
+        printInfo('git url', entry.gitUrl);
+        printInfo('branch', entry.branch);
+        printInfo('clone', `(see ~/.olam/state/skill-sources/${entry.id})`);
+        switch (hookStatus) {
+            case 'installed':
+                printInfo('hook', `installed (${scope} scope) at ${hookFilePath}`);
+                if (hookBackupPath)
+                    printInfo('backup', hookBackupPath);
+                break;
+            case 'already-present':
+                printInfo('hook', `already installed at ${hookFilePath}`);
+                break;
+            case 'no-op':
+                printInfo('hook', `no change at ${hookFilePath}`);
+                break;
+        }
+        printInfo('sync', `${syncedArtifacts} artifact(s) deployed`);
+        console.log();
+        console.log(pc.dim('  Open a new Claude Code session to pick up the deployed skills.'));
+    });
+}
+//# sourceMappingURL=skills-onboard.js.map

package/dist/commands/skills-onboard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-onboard.js","sourceRoot":"","sources":["../../src/commands/skills-onboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,EACtB,yBAAyB,EACzB,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,SAAS,GAEV,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhF,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAUD,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,MAAM,GACV,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC;QACnD,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;IAEpF,MAAM;SACH,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CACV,gGAAgG,CACjG;SACA,cAAc,CAAC,eAAe,EAAE,wCAAwC,CAAC;SACzE,cAAc,CAAC,iBAAiB,EAAE,6DAA6D,CAAC;SAChG,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,CAAC;SACtD,MAAM,CACL,SAAS,EACT,8GAA8G,CAC/G;SACA,MAAM,CACL,iBAAiB,EACjB,6FAA6F,EAC7F,SAAS,CACV;SACA,MAAM,CAAC,KAAK,EAAE,IAAiB,EAAE,EAAE;QAClC,MAAM,KAAK,GAAoB,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1E,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,6DAA6D;QAC7D,mDAAmD;QACnD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,gBAAgB,CAAC;oBACf,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;oBAC9B,MAAM,EAAE,eAAe;oBACvB,WAAW,EAAE,iBAAiB;oBAC9B,IAAI,EAAE,mEAAmE;iBAC1E,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;YACD,UAAU,CACR,4EAA4E;gBAC1E,gFAAgF;gBAChF,uFAAuF,CAC1F,CAAC;YACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,KAAoD,CAAC;QACzD,IAAI,CAAC;YACH,KAAK,GAAG,cAAc,CAAC;gBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM;gBAC7B,WAAW,EAAE,MAAM;aACpB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,gBAAgB,CAAC;oBACf,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC;oBAC9B,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,MAAM;oBACnB,IAAI,EAAE,qBAAqB,SAAS,CAAC,GAAG,CAAC,EAAE;iBAC5C,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,kEAAkE;QAClE,0DAA0D;QAC1D,kEAAkE;QAClE,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,gBAAgB,CAAC;gBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,EAAE,EAAE,KAAK,CAAC,EAAE;aACb,CAAC,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YACzB,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,IAAI,CAAC;gBACH,gBAAgB,CAAC;oBACf,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;oBAC/B,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,MAAM;oBACnB,QAAQ,EAAE,KAAK,CAAC,EAAE;oBAClB,IAAI,EAAE,uBAAuB,SAAS,CAAC,GAAG,CAAC,EAAE;iBAC9C,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,kEAAkE;QAClE,iEAAiE;QACjE,kDAAkD;QAClD,kEAAkE;QAClE,MAAM,YAAY,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACtD,IAAI,UAAqD,CAAC;QAC1D,IAAI,cAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;YACrD,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACjC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,IAAI,CAAC;gBACH,gBAAgB,CAAC;oBACf,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;oBAC/B,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,MAAM;oBACnB,QAAQ,EAAE,KAAK,CAAC,EAAE;oBAClB,IAAI,EAAE,8BAA8B,SAAS,CAAC,GAAG,CAAC,EAAE;iBACrD,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,UAAU,CAAC,wBAAwB,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,kEAAkE;QAClE,gEAAgE;QAChE,kEAAkE;QAClE,6DAA6D;QAC7D,+DAA+D;QAC/D,kEAAkE;QAClE,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,CAAC,CAAC;YACrC,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACjC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,IAAI,CAAC;gBACH,gBAAgB,CAAC;oBACf,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;oBAC/B,MAAM,EAAE,QAAQ;oBAChB,WAAW,EAAE,MAAM;oBACnB,QAAQ,EAAE,KAAK,CAAC,EAAE;oBAClB,IAAI,EAAE,sBAAsB,SAAS,CAAC,GAAG,CAAC,EAAE;iBAC7C,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,UAAU,CAAC,gBAAgB,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,kEAAkE;QAClE,+CAA+C;QAC/C,kEAAkE;QAClE,WAAW,CAAC,2BAA2B,CAAC,CAAC;QACzC,YAAY,CAAC,eAAe,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClF,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACnC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,SAAS,CAAC,OAAO,EAAE,oCAAoC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,WAAW;gBACd,SAAS,CAAC,MAAM,EAAE,cAAc,KAAK,cAAc,YAAY,EAAE,CAAC,CAAC;gBACnE,IAAI,cAAc;oBAAE,SAAS,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;gBACxD,MAAM;YACR,KAAK,iBAAiB;gBACpB,SAAS,CAAC,MAAM,EAAE,wBAAwB,YAAY,EAAE,CAAC,CAAC;gBAC1D,MAAM;YACR,KAAK,OAAO;gBACV,SAAS,CAAC,MAAM,EAAE,gBAAgB,YAAY,EAAE,CAAC,CAAC;gBAClD,MAAM;QACV,CAAC;QACD,SAAS,CAAC,MAAM,EAAE,GAAG,eAAe,uBAAuB,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/skills-shadow-backups.d.ts

@@ -0,0 +1,15 @@
+/**
+ * olam skills shadow-backups — manage A4's quarantine files.
+ *
+ *   olam skills shadow-backups list                       all backups + ages
+ *   olam skills shadow-backups prune [--older-than=<dur>] delete old ones
+ *                                    [--all --force]      OR delete every one
+ *                                    [--dry-run]
+ *   olam skills shadow-backups restore <path> [--force]   move back to original
+ *
+ * T2 mitigation: prevents unbounded backup growth without ever touching a
+ * non-shadow-backup file (strict `.shadow-backup-<digits>` suffix match).
+ */
+import type { Command } from 'commander';
+export declare function registerSkillsShadowBackups(program: Command): void;
+//# sourceMappingURL=skills-shadow-backups.d.ts.map

package/dist/commands/skills-shadow-backups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills-shadow-backups.d.ts","sourceRoot":"","sources":["../../src/commands/skills-shadow-backups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0CzC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsFlE"}

package/dist/commands/skills-shadow-backups.js

@@ -0,0 +1,132 @@
+/**
+ * olam skills shadow-backups — manage A4's quarantine files.
+ *
+ *   olam skills shadow-backups list                       all backups + ages
+ *   olam skills shadow-backups prune [--older-than=<dur>] delete old ones
+ *                                    [--all --force]      OR delete every one
+ *                                    [--dry-run]
+ *   olam skills shadow-backups restore <path> [--force]   move back to original
+ *
+ * T2 mitigation: prevents unbounded backup growth without ever touching a
+ * non-shadow-backup file (strict `.shadow-backup-<digits>` suffix match).
+ */
+import * as fs from 'node:fs';
+import pc from 'picocolors';
+import { listShadowBackups, pruneShadowBackups, restoreShadowBackup, parseDurationToMs, } from '@olam/core/src/skill-sources/index.js';
+import { printError, printHeader, printSuccess } from '../output.js';
+function asMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function formatAge(ms) {
+    if (ms < 0)
+        return '<future>';
+    const d = Math.floor(ms / 86_400_000);
+    if (d >= 1)
+        return `${d}d`;
+    const h = Math.floor(ms / 3_600_000);
+    if (h >= 1)
+        return `${h}h`;
+    const m = Math.floor(ms / 60_000);
+    if (m >= 1)
+        return `${m}m`;
+    const s = Math.floor(ms / 1_000);
+    return `${s}s`;
+}
+function formatSize(bytes) {
+    if (bytes < 1024)
+        return `${bytes}B`;
+    if (bytes < 1024 * 1024)
+        return `${(bytes / 1024).toFixed(1)}KB`;
+    return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
+}
+function printBackupRows(backups) {
+    for (const b of backups) {
+        const when = new Date(b.epochSeconds * 1000).toISOString().slice(0, 10);
+        console.log(`  ${pc.dim(formatAge(b.ageMs).padStart(6))}  ${formatSize(b.sizeBytes).padStart(7)}  ${pc.dim(when)}  ${b.bucket}/${pc.bold(b.basename)}`);
+    }
+}
+export function registerSkillsShadowBackups(program) {
+    const skills = program.commands.find((c) => c.name() === 'skills') ??
+        program.command('skills').description('Manage skill sources and synchronization');
+    const sb = skills
+        .command('shadow-backups')
+        .description('Manage `.shadow-backup-<epoch>` quarantine files left by `olam skills sync`');
+    sb.command('list')
+        .description('List all shadow-backup files under ~/.claude/')
+        .action(() => {
+        const all = listShadowBackups();
+        if (all.length === 0) {
+            console.log(pc.dim('No shadow-backup files under ~/.claude/.'));
+            return;
+        }
+        printHeader(`${all.length} shadow backup(s)`);
+        console.log(pc.dim('   age      size  created     bucket/basename'));
+        printBackupRows(all);
+    });
+    sb.command('prune')
+        .description('Delete shadow-backup files older than a duration (e.g. 30d) OR all of them with --all --force')
+        .option('--older-than <duration>', 'Delete backups older than this duration (e.g. 30d, 7d, 24h, 2w)', '30d')
+        .option('--all', 'Delete every shadow-backup file (requires --force)')
+        .option('--force', 'Confirm deletion when --all is used')
+        .option('--dry-run', 'Show what would be deleted without deleting')
+        .action((opts) => {
+        try {
+            let pruneOpts;
+            if (opts.all === true) {
+                if (opts.force !== true) {
+                    printError('--all requires --force (refuses accidental wipes)');
+                    process.exitCode = 1;
+                    return;
+                }
+                pruneOpts = { all: true, dryRun: opts.dryRun };
+            }
+            else {
+                const olderThanMs = parseDurationToMs(opts.olderThan);
+                if (olderThanMs === undefined) {
+                    printError(`unrecognized --older-than value "${opts.olderThan}" (expected like "30d", "7d", "24h", "2w")`);
+                    process.exitCode = 1;
+                    return;
+                }
+                pruneOpts = { olderThanMs, dryRun: opts.dryRun };
+            }
+            const result = pruneShadowBackups(pruneOpts);
+            const action = opts.dryRun ? 'would delete' : 'deleted';
+            if (result.deleted.length === 0) {
+                console.log(pc.dim(`No shadow-backups match — ${result.skipped.length} kept`));
+                return;
+            }
+            printHeader(`${action} ${result.deleted.length} shadow backup(s) (${result.skipped.length} kept)`);
+            printBackupRows(result.deleted);
+            if (opts.dryRun) {
+                console.log(pc.dim('\n(dry-run — re-run without --dry-run to delete)'));
+            }
+            else {
+                printSuccess(`pruned ${result.deleted.length} backup(s)`);
+            }
+        }
+        catch (err) {
+            printError(asMessage(err));
+            process.exitCode = 1;
+        }
+    });
+    sb.command('restore')
+        .description('Move a shadow-backup file back to its original path')
+        .argument('<path>', 'Absolute path to the .shadow-backup-<epoch> file')
+        .option('--force', 'Overwrite the original path if it already exists')
+        .action((p, opts) => {
+        try {
+            if (!fs.existsSync(p)) {
+                printError(`backup file not found: ${p}`);
+                process.exitCode = 1;
+                return;
+            }
+            const result = restoreShadowBackup({ backupPath: p, force: opts.force });
+            printSuccess(`restored → ${result.restoredTo}`);
+        }
+        catch (err) {
+            printError(asMessage(err));
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=skills-shadow-backups.js.map