@skillsmith/cli 0.6.2 → 0.6.4

package/dist/src/commands/audit-sources.action.js

@@ -0,0 +1,300 @@
+/**
+ * @fileoverview Action implementation for `sklx audit sources`.
+ * @module @skillsmith/cli/commands/audit-sources.action
+ * @see SMI-5407
+ *
+ * Wires SourceRecoveryService (with real findCandidatesByName over the CLI DB)
+ * and backfillManifest. Applies an already_tracked overlay after recovery (the
+ * core service cannot know the current manifest state).
+ *
+ * Safety:
+ *   - Dry-run unless --apply.
+ *   - --apply requires typed phrase `BACKFILL SOURCES` (waived by --yes).
+ *   - --write-frontmatter requires --force-write-frontmatter and prints a bold
+ *     stderr WARNING before proceeding.
+ *
+ * Output:
+ *   Human: === Skillsmith — Source Recovery === + table + footer summary.
+ *   --json: { skills, summary } to stdout, no prompts, no file mutation.
+ */
+import { input } from '@inquirer/prompts';
+import chalk from 'chalk';
+import { hashContent } from '@skillsmith/core/services/skill-installation-helpers';
+import { SourceRecoveryService, defaultSkillsRoot, backfillManifest, parseRepoUrl, METHOD_LABELS, } from '@skillsmith/core';
+import { withTelemetry } from '@skillsmith/core/telemetry';
+import { openCliDatabase } from '../utils/open-database.js';
+import { loadManifest } from '../utils/manifest.js';
+import { sanitizeError } from '../utils/sanitize.js';
+import { DEFAULT_DB_PATH } from '../config.js';
+// ============================================================================
+// Constants
+// ============================================================================
+const BACKFILL_PHRASE = 'BACKFILL SOURCES';
+const CONFIDENCE_BADGES = {
+    exact: '[EXACT]',
+    high: '[HIGH]',
+    medium: '[MEDIUM]',
+    low: '[LOW]',
+    'user-specified': '[SET]',
+    unknown: '[-]',
+};
+// ============================================================================
+// Helpers
+// ============================================================================
+/** Parse `--set` pairs like `"dirName=owner/repo"` → Record. */
+function parseSetPairs(pairs) {
+    if (!pairs || pairs.length === 0)
+        return {};
+    const out = {};
+    for (const pair of pairs) {
+        const eq = pair.indexOf('=');
+        if (eq < 1) {
+            console.error(chalk.yellow(`[audit sources] ignoring malformed --set pair: ${pair}`));
+            continue;
+        }
+        out[pair.slice(0, eq)] = pair.slice(eq + 1);
+    }
+    return out;
+}
+/** Parse `minConfidence` CLI value; fall back to `'high'` on unknown input. */
+function parseMinConfidence(value) {
+    const valid = ['exact', 'high', 'medium', 'low', 'user-specified'];
+    const v = (value ?? 'high');
+    return valid.includes(v) ? v : 'high';
+}
+/**
+ * Apply the already_tracked overlay: a skill whose manifest entry already has a
+ * non-empty source should be marked `already_tracked` (the core service cannot
+ * know the current manifest state).
+ *
+ * Mutates `report.skills` in place and recomputes `report.summary`.
+ */
+async function overlayAlreadyTracked(report) {
+    const manifest = await loadManifest();
+    const installed = manifest.installedSkills ?? {};
+    for (const skill of report.skills) {
+        const entry = installed[skill.skillName];
+        if (entry && typeof entry.source === 'string' && entry.source.trim().length > 0) {
+            skill.status = 'already_tracked';
+        }
+    }
+    // Recompute summary totals from mutated statuses.
+    report.summary.recovered = 0;
+    report.summary.already_tracked = 0;
+    report.summary.unknown = 0;
+    report.summary.skipped_backup = 0;
+    for (const skill of report.skills) {
+        report.summary[skill.status] += 1;
+    }
+}
+// ============================================================================
+// Output — human-readable
+// ============================================================================
+const COL_SKILL = 24;
+const COL_SOURCE = 46;
+const COL_CONF = 12;
+function pad(s, n) {
+    return s.length >= n ? s.slice(0, n - 1) + ' ' : s.padEnd(n);
+}
+function sourceCell(skill) {
+    if (skill.status === 'already_tracked')
+        return '(already tracked)';
+    if (skill.status === 'skipped_backup')
+        return '(backup — skipped)';
+    if (skill.candidates.length > 1)
+        return '(ambiguous)';
+    if (!skill.recoveredSource)
+        return '(unresolved)';
+    return skill.recoveredSource.url;
+}
+function confCell(skill) {
+    if (skill.status === 'already_tracked' || skill.status === 'skipped_backup')
+        return '-';
+    return CONFIDENCE_BADGES[skill.confidence] ?? '?';
+}
+function methodCell(skill) {
+    if (skill.status === 'already_tracked' || skill.status === 'skipped_backup')
+        return '-';
+    if (!skill.method)
+        return '-';
+    return METHOD_LABELS[skill.method] ?? skill.method;
+}
+function printHumanReport(report, applying) {
+    console.log(chalk.bold.blue('\n=== Skillsmith — Source Recovery ===\n'));
+    const hdr = pad('skill', COL_SKILL) +
+        '| ' +
+        pad('source', COL_SOURCE) +
+        '| ' +
+        pad('confidence', COL_CONF) +
+        '| method';
+    const sep = '-'.repeat(hdr.length);
+    console.log(hdr);
+    console.log(sep);
+    for (const skill of report.skills) {
+        const row = pad(skill.skillName, COL_SKILL) +
+            '| ' +
+            pad(sourceCell(skill), COL_SOURCE) +
+            '| ' +
+            pad(confCell(skill), COL_CONF) +
+            '| ' +
+            methodCell(skill);
+        console.log(row);
+        // Multi-candidate indented row for ambiguous name matches.
+        if (skill.candidates.length > 1) {
+            const parts = skill.candidates
+                .map((c, i) => `(${i + 1}) ${c.owner}/${c.repo}`)
+                .join(' ');
+            console.log(chalk.dim(`  -> ${parts} [ambiguous — --set or --embedding]`));
+        }
+    }
+    console.log();
+    const s = report.summary;
+    const exactCount = report.skills.filter((sk) => sk.status === 'recovered' && sk.confidence === 'exact').length;
+    const highCount = report.skills.filter((sk) => sk.status === 'recovered' && (sk.confidence === 'high' || sk.confidence === 'user-specified')).length;
+    console.log(chalk.bold(`Summary: ${s.total} scanned, ${s.recovered} recovered ` +
+        `(${exactCount} exact, ${highCount} high), ` +
+        `${s.already_tracked} already-tracked, ` +
+        `${s.unknown} unresolved, ` +
+        `${s.skipped_backup} backups skipped.`));
+    if (!applying) {
+        console.log(chalk.dim('Dry run — --apply to backfill.'));
+    }
+    console.log();
+}
+// ============================================================================
+// Typed-confirmation gate
+// ============================================================================
+async function requireBackfillPhrase() {
+    const answer = await input({
+        message: `Type ${chalk.bold(BACKFILL_PHRASE)} to confirm writing recovered sources to the manifest`,
+    });
+    if (answer !== BACKFILL_PHRASE) {
+        throw new Error(`Confirmation phrase mismatch — operation aborted. ` + `Must be exactly: ${BACKFILL_PHRASE}`);
+    }
+}
+// ============================================================================
+// Main entry
+// ============================================================================
+export async function runAuditSources(options) {
+    const skillsRoot = options.skillsRoot ?? defaultSkillsRoot();
+    const setOverrides = parseSetPairs(options.set);
+    const minConfidence = parseMinConfidence(options.minConfidence);
+    // --write-frontmatter requires --force-write-frontmatter.
+    if (options.writeFrontmatter && !options.forceWriteFrontmatter) {
+        console.error(chalk.red('--write-frontmatter requires --force-write-frontmatter. ' +
+            'Re-run with both flags to modify SKILL.md files inside installed skill directories.'));
+        process.exit(1);
+        return;
+    }
+    // Bold warning when frontmatter mutation is armed.
+    if (options.writeFrontmatter && options.forceWriteFrontmatter) {
+        console.error(chalk.bold.yellow('WARNING: --write-frontmatter will modify SKILL.md files inside ' +
+            'git-tracked skill repos. This operation is irreversible without a git reset.'));
+    }
+    // Open local DB (required for findCandidatesByName).
+    const db = await openCliDatabase(options.db);
+    let report;
+    try {
+        const findCandidatesByName = async (name) => {
+            const rows = db
+                .prepare('SELECT id, name, repo_url, quality_score FROM skills WHERE name = ?')
+                .all(name);
+            const candidates = [];
+            for (const row of rows) {
+                if (!row.repo_url)
+                    continue;
+                try {
+                    const parsed = parseRepoUrl(row.repo_url);
+                    candidates.push({
+                        id: row.id,
+                        name: row.name,
+                        owner: parsed.owner,
+                        repo: parsed.repo,
+                        url: `https://github.com/${parsed.owner}/${parsed.repo}`,
+                        qualityScore: row.quality_score ?? 0,
+                    });
+                }
+                catch {
+                    // Non-GitHub repo_url — skip candidate.
+                }
+            }
+            return candidates;
+        };
+        const service = new SourceRecoveryService({ hashContent, findCandidatesByName });
+        report = await service.recoverSources({
+            skillsRoot,
+            enableEmbedding: options.embedding,
+            enableCatalogHint: options.catalogHint,
+        });
+    }
+    finally {
+        db.close();
+    }
+    // Overlay already_tracked status from the current manifest.
+    await overlayAlreadyTracked(report);
+    // --json: emit raw data, no prompts, no writes.
+    if (options.json) {
+        process.stdout.write(JSON.stringify({ skills: report.skills, summary: report.summary }, null, 2));
+        process.stdout.write('\n');
+        return;
+    }
+    printHumanReport(report, options.apply);
+    if (!options.apply)
+        return;
+    // --apply: confirm and write.
+    if (!options.yes) {
+        await requireBackfillPhrase();
+    }
+    const outcome = await backfillManifest(report, {
+        minConfidence,
+        apply: true,
+        setOverrides,
+        writeFrontmatter: options.writeFrontmatter,
+    });
+    if (outcome.written.length > 0) {
+        console.log(chalk.green(`Backfilled ${outcome.written.length} skill(s): ${outcome.written.join(', ')}`));
+    }
+    else {
+        console.log(chalk.dim('Nothing new to backfill.'));
+    }
+    if (outcome.skipped.length > 0) {
+        console.log(chalk.dim(`Skipped: ${outcome.skipped.join(', ')}`));
+    }
+}
+// ============================================================================
+// withTelemetry-wrapped export (SMI-5127+)
+// ============================================================================
+async function auditSourcesActionImpl(skillsRoot, opts) {
+    try {
+        await runAuditSources({
+            skillsRoot,
+            apply: opts['apply'] ?? false,
+            yes: opts['yes'] ?? false,
+            set: opts['set'],
+            minConfidence: opts['minConfidence'] ?? 'high',
+            json: opts['json'] ?? false,
+            embedding: opts['embedding'] ?? false,
+            catalogHint: opts['catalogHint'] ?? false,
+            writeFrontmatter: opts['writeFrontmatter'] ?? false,
+            forceWriteFrontmatter: opts['forceWriteFrontmatter'] ?? false,
+            db: opts['db'] ?? DEFAULT_DB_PATH,
+        });
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : sanitizeError(error);
+        if (msg.startsWith('Confirmation phrase mismatch')) {
+            console.error(chalk.yellow(msg));
+        }
+        else {
+            console.error(chalk.red('Error:'), msg);
+        }
+        process.exit(1);
+    }
+}
+export const auditSourcesAction = withTelemetry(auditSourcesActionImpl, {
+    source: 'cli',
+    extractSkillId: () => 'audit-sources',
+    extractFramework: () => 'cli',
+});
+export { BACKFILL_PHRASE };
+//# sourceMappingURL=audit-sources.action.js.map

package/dist/src/commands/audit-sources.action.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-sources.action.js","sourceRoot":"","sources":["../../../src/commands/audit-sources.action.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACzC,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,WAAW,EAAE,MAAM,sDAAsD,CAAA;AAClF,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,GAKd,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,MAAM,eAAe,GAAG,kBAAkB,CAAA;AAE1C,MAAM,iBAAiB,GAAuC;IAC5D,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,UAAU;IAClB,GAAG,EAAE,OAAO;IACZ,gBAAgB,EAAE,OAAO;IACzB,OAAO,EAAE,KAAK;CACf,CAAA;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,gEAAgE;AAChE,SAAS,aAAa,CAAC,KAA2B;IAChD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAC3C,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,kDAAkD,IAAI,EAAE,CAAC,CAAC,CAAA;YACrF,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,+EAA+E;AAC/E,SAAS,kBAAkB,CAAC,KAAyB;IACnD,MAAM,KAAK,GAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAA;IACxF,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,MAAM,CAAuB,CAAA;IACjD,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AACvC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,qBAAqB,CAAC,MAAsB;IACzD,MAAM,QAAQ,GAAG,MAAM,YAAY,EAAE,CAAA;IACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAA;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACxC,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChF,KAAK,CAAC,MAAM,GAAG,iBAAiB,CAAA;QAClC,CAAC;IACH,CAAC;IACD,kDAAkD;IAClD,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAA;IAC5B,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,CAAC,CAAA;IAClC,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,CAAC,CAAA;IAC1B,MAAM,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAA;IACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnC,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,MAAM,SAAS,GAAG,EAAE,CAAA;AACpB,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAA;AAEnB,SAAS,GAAG,CAAC,CAAS,EAAE,CAAS;IAC/B,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,KAA0B;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB;QAAE,OAAO,mBAAmB,CAAA;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB;QAAE,OAAO,oBAAoB,CAAA;IAClE,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,aAAa,CAAA;IACrD,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,cAAc,CAAA;IACjD,OAAO,KAAK,CAAC,eAAe,CAAC,GAAG,CAAA;AAClC,CAAC;AAED,SAAS,QAAQ,CAAC,KAA0B;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB;QAAE,OAAO,GAAG,CAAA;IACvF,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,CAAA;AACnD,CAAC;AAED,SAAS,UAAU,CAAC,KAA0B;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB;QAAE,OAAO,GAAG,CAAA;IACvF,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,GAAG,CAAA;IAC7B,OAAO,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAA;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAsB,EAAE,QAAiB;IACjE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC,CAAA;IAExE,MAAM,GAAG,GACP,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC;QACvB,IAAI;QACJ,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC;QACzB,IAAI;QACJ,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC;QAC3B,UAAU,CAAA;IACZ,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAClC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAChB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAEhB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,GAAG,GACP,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC;YAC/B,IAAI;YACJ,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;YAClC,IAAI;YACJ,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC;YAC9B,IAAI;YACJ,UAAU,CAAC,KAAK,CAAC,CAAA;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAEhB,2DAA2D;QAC3D,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU;iBAC3B,GAAG,CAAC,CAAC,CAAoB,EAAE,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;iBAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;YACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,qCAAqC,CAAC,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,EAAE,CAAA;IAEb,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAA;IACxB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CACrC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,WAAW,IAAI,EAAE,CAAC,UAAU,KAAK,OAAO,CAC/D,CAAC,MAAM,CAAA;IACR,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CACpC,CAAC,EAAE,EAAE,EAAE,CACL,EAAE,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,MAAM,IAAI,EAAE,CAAC,UAAU,KAAK,gBAAgB,CAAC,CAChG,CAAC,MAAM,CAAA;IAER,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,YAAY,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,SAAS,aAAa;QACtD,IAAI,UAAU,WAAW,SAAS,UAAU;QAC5C,GAAG,CAAC,CAAC,eAAe,oBAAoB;QACxC,GAAG,CAAC,CAAC,OAAO,eAAe;QAC3B,GAAG,CAAC,CAAC,cAAc,mBAAmB,CACzC,CACF,CAAA;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,CAAA;IAC1D,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAA;AACf,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,KAAK,UAAU,qBAAqB;IAClC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,OAAO,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,uDAAuD;KACpG,CAAC,CAAA;IACF,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,oDAAoD,GAAG,oBAAoB,eAAe,EAAE,CAC7F,CAAA;IACH,CAAC;AACH,CAAC;AAoBD,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA4B;IAChE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAA;IAC5D,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/C,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAE/D,0DAA0D;IAC1D,IAAI,OAAO,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAC/D,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,GAAG,CACP,0DAA0D;YACxD,qFAAqF,CACxF,CACF,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACf,OAAM;IACR,CAAC;IAED,mDAAmD;IACnD,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAC9D,OAAO,CAAC,KAAK,CACX,KAAK,CAAC,IAAI,CAAC,MAAM,CACf,iEAAiE;YAC/D,8EAA8E,CACjF,CACF,CAAA;IACH,CAAC;IAED,qDAAqD;IACrD,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5C,IAAI,MAAsB,CAAA;IAE1B,IAAI,CAAC;QACH,MAAM,oBAAoB,GAAG,KAAK,EAAE,IAAY,EAAgC,EAAE;YAOhF,MAAM,IAAI,GAAG,EAAE;iBACZ,OAAO,CAAW,qEAAqE,CAAC;iBACxF,GAAG,CAAC,IAAI,CAAC,CAAA;YAEZ,MAAM,UAAU,GAAwB,EAAE,CAAA;YAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,GAAG,CAAC,QAAQ;oBAAE,SAAQ;gBAC3B,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;oBACzC,UAAU,CAAC,IAAI,CAAC;wBACd,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,KAAK,EAAE,MAAM,CAAC,KAAK;wBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,GAAG,EAAE,sBAAsB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE;wBACxD,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC;qBACrC,CAAC,CAAA;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,wCAAwC;gBAC1C,CAAC;YACH,CAAC;YACD,OAAO,UAAU,CAAA;QACnB,CAAC,CAAA;QAED,MAAM,OAAO,GAAG,IAAI,qBAAqB,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC,CAAA;QAEhF,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;YACpC,UAAU;YACV,eAAe,EAAE,OAAO,CAAC,SAAS;YAClC,iBAAiB,EAAE,OAAO,CAAC,WAAW;SACvC,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAA;IACZ,CAAC;IAED,4DAA4D;IAC5D,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAEnC,gDAAgD;IAChD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAC5E,CAAA;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1B,OAAM;IACR,CAAC;IAED,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAEvC,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAM;IAE1B,8BAA8B;IAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACjB,MAAM,qBAAqB,EAAE,CAAA;IAC/B,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE;QAC7C,aAAa;QACb,KAAK,EAAE,IAAI;QACX,YAAY;QACZ,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC,CAAA;IAEF,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,cAAc,OAAO,CAAC,OAAO,CAAC,MAAM,cAAc,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAC5F,CAAA;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IAClE,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,2CAA2C;AAC3C,+EAA+E;AAE/E,KAAK,UAAU,sBAAsB,CACnC,UAA8B,EAC9B,IAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,eAAe,CAAC;YACpB,UAAU;YACV,KAAK,EAAG,IAAI,CAAC,OAAO,CAAa,IAAI,KAAK;YAC1C,GAAG,EAAG,IAAI,CAAC,KAAK,CAAa,IAAI,KAAK;YACtC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAyB;YACxC,aAAa,EAAG,IAAI,CAAC,eAAe,CAAwB,IAAI,MAAM;YACtE,IAAI,EAAG,IAAI,CAAC,MAAM,CAAa,IAAI,KAAK;YACxC,SAAS,EAAG,IAAI,CAAC,WAAW,CAAa,IAAI,KAAK;YAClD,WAAW,EAAG,IAAI,CAAC,aAAa,CAAa,IAAI,KAAK;YACtD,gBAAgB,EAAG,IAAI,CAAC,kBAAkB,CAAa,IAAI,KAAK;YAChE,qBAAqB,EAAG,IAAI,CAAC,uBAAuB,CAAa,IAAI,KAAK;YAC1E,EAAE,EAAG,IAAI,CAAC,IAAI,CAAwB,IAAI,eAAe;SAC1D,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QACzE,IAAI,GAAG,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;YACnD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAClC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC,sBAAsB,EAAE;IACtE,MAAM,EAAE,KAAK;IACb,cAAc,EAAE,GAAG,EAAE,CAAC,eAAe;IACrC,gBAAgB,EAAE,GAAG,EAAE,CAAC,KAAK;CAC9B,CAAC,CAAA;AAEF,OAAO,EAAE,eAAe,EAAE,CAAA"}

package/dist/src/commands/audit-sources.d.ts

@@ -0,0 +1,37 @@
+/**
+ * @fileoverview `sklx audit sources` — skill source provenance recovery subcommand factory.
+ * @module @skillsmith/cli/commands/audit-sources
+ * @see SMI-5407
+ *
+ * Sibling of `sklx audit advisories` and `sklx audit collisions`.
+ * Implementation lives in `audit-sources.action.ts` (SMI-5127+ split).
+ *
+ * Flags:
+ *   [skillsRoot]            Optional positional: override the scan root
+ *                           (default: ~/.claude/skills).
+ *   --apply                 Write recovered sources to the manifest.
+ *                           Dry-run when omitted.
+ *   --yes                   Skip typed-confirmation gate (requires --apply).
+ *   --set <pair...>         Override: dirName=owner/repo. Repeatable.
+ *   --min-confidence <c>    Minimum confidence to backfill.
+ *                           One of: exact|high|medium|low. Default: high.
+ *   --json                  Emit JSON to stdout; no prompts; no file mutation.
+ *   --embedding             Enable embedding tiebreak tier (off by default).
+ *   --catalog-hint          Enable catalog / author hint tier (off by default).
+ *   --write-frontmatter     Write repository: into non-git SKILL.md frontmatter.
+ *                           Requires --force-write-frontmatter.
+ *   --force-write-frontmatter  Confirm SKILL.md mutation (required with
+ *                              --write-frontmatter). Prints a bold warning.
+ *   -d, --db <path>         SQLite database path (default: ~/.skillsmith/skills.db).
+ *
+ * Community tier (no requireTier call). Read-only by default; --apply enables
+ * the manifest write path.
+ */
+import { Command } from 'commander';
+/**
+ * Build the `audit sources` subcommand. Registered in `createAuditCommand()`
+ * beside `advisories` and `collisions`.
+ */
+export declare function createAuditSourcesSubcommand(): Command;
+export default createAuditSourcesSubcommand;
+//# sourceMappingURL=audit-sources.d.ts.map

package/dist/src/commands/audit-sources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-sources.d.ts","sourceRoot":"","sources":["../../../src/commands/audit-sources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAInC;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,OAAO,CA0BtD;AAED,eAAe,4BAA4B,CAAA"}

package/dist/src/commands/audit-sources.js

@@ -0,0 +1,55 @@
+/**
+ * @fileoverview `sklx audit sources` — skill source provenance recovery subcommand factory.
+ * @module @skillsmith/cli/commands/audit-sources
+ * @see SMI-5407
+ *
+ * Sibling of `sklx audit advisories` and `sklx audit collisions`.
+ * Implementation lives in `audit-sources.action.ts` (SMI-5127+ split).
+ *
+ * Flags:
+ *   [skillsRoot]            Optional positional: override the scan root
+ *                           (default: ~/.claude/skills).
+ *   --apply                 Write recovered sources to the manifest.
+ *                           Dry-run when omitted.
+ *   --yes                   Skip typed-confirmation gate (requires --apply).
+ *   --set <pair...>         Override: dirName=owner/repo. Repeatable.
+ *   --min-confidence <c>    Minimum confidence to backfill.
+ *                           One of: exact|high|medium|low. Default: high.
+ *   --json                  Emit JSON to stdout; no prompts; no file mutation.
+ *   --embedding             Enable embedding tiebreak tier (off by default).
+ *   --catalog-hint          Enable catalog / author hint tier (off by default).
+ *   --write-frontmatter     Write repository: into non-git SKILL.md frontmatter.
+ *                           Requires --force-write-frontmatter.
+ *   --force-write-frontmatter  Confirm SKILL.md mutation (required with
+ *                              --write-frontmatter). Prints a bold warning.
+ *   -d, --db <path>         SQLite database path (default: ~/.skillsmith/skills.db).
+ *
+ * Community tier (no requireTier call). Read-only by default; --apply enables
+ * the manifest write path.
+ */
+import { Command } from 'commander';
+import { DEFAULT_DB_PATH } from '../config.js';
+import { auditSourcesAction } from './audit-sources.action.js';
+/**
+ * Build the `audit sources` subcommand. Registered in `createAuditCommand()`
+ * beside `advisories` and `collisions`.
+ */
+export function createAuditSourcesSubcommand() {
+    return new Command('sources')
+        .description('Recover the canonical GitHub source of locally-installed skills ' +
+        'and optionally backfill ~/.skillsmith/manifest.json')
+        .argument('[skillsRoot]', 'Root directory to scan (default: ~/.claude/skills)')
+        .option('--apply', 'Write recovered sources to the manifest (dry-run by default)', false)
+        .option('--yes', 'Skip typed-confirmation phrase (requires --apply)', false)
+        .option('--set <pair...>', 'Override source for a skill: dirName=owner/repo (repeatable)')
+        .option('--min-confidence <c>', 'Minimum confidence to backfill: exact|high|medium|low', 'high')
+        .option('--json', 'Emit JSON to stdout; no prompts; no file mutation', false)
+        .option('--embedding', 'Enable embedding tiebreak tier (off by default)', false)
+        .option('--catalog-hint', 'Enable catalog / author hint tier (off by default)', false)
+        .option('--write-frontmatter', 'Write repository: into non-git SKILL.md frontmatter (requires --force-write-frontmatter)', false)
+        .option('--force-write-frontmatter', 'Confirm SKILL.md mutation — required with --write-frontmatter (prints a bold warning)', false)
+        .option('-d, --db <path>', 'Database file path', DEFAULT_DB_PATH)
+        .action(auditSourcesAction);
+}
+export default createAuditSourcesSubcommand;
+//# sourceMappingURL=audit-sources.js.map

package/dist/src/commands/audit-sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-sources.js","sourceRoot":"","sources":["../../../src/commands/audit-sources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAE9D;;;GAGG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;SAC1B,WAAW,CACV,kEAAkE;QAChE,qDAAqD,CACxD;SACA,QAAQ,CAAC,cAAc,EAAE,oDAAoD,CAAC;SAC9E,MAAM,CAAC,SAAS,EAAE,8DAA8D,EAAE,KAAK,CAAC;SACxF,MAAM,CAAC,OAAO,EAAE,mDAAmD,EAAE,KAAK,CAAC;SAC3E,MAAM,CAAC,iBAAiB,EAAE,8DAA8D,CAAC;SACzF,MAAM,CAAC,sBAAsB,EAAE,uDAAuD,EAAE,MAAM,CAAC;SAC/F,MAAM,CAAC,QAAQ,EAAE,mDAAmD,EAAE,KAAK,CAAC;SAC5E,MAAM,CAAC,aAAa,EAAE,iDAAiD,EAAE,KAAK,CAAC;SAC/E,MAAM,CAAC,gBAAgB,EAAE,oDAAoD,EAAE,KAAK,CAAC;SACrF,MAAM,CACL,qBAAqB,EACrB,0FAA0F,EAC1F,KAAK,CACN;SACA,MAAM,CACL,2BAA2B,EAC3B,uFAAuF,EACvF,KAAK,CACN;SACA,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,eAAe,CAAC;SAChE,MAAM,CAAC,kBAAkB,CAAC,CAAA;AAC/B,CAAC;AAED,eAAe,4BAA4B,CAAA"}

package/dist/src/commands/audit-sources.test.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview Unit tests for `sklx audit sources` CLI command.
+ * @see SMI-5407: Skill Source Provenance Recovery
+ *
+ * Tests the action layer (`runAuditSources`) with injected mocks so the test
+ * suite runs fully offline without a real DB or skills directory.
+ */
+export {};
+//# sourceMappingURL=audit-sources.test.d.ts.map

package/dist/src/commands/audit-sources.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-sources.test.d.ts","sourceRoot":"","sources":["../../../src/commands/audit-sources.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/src/commands/audit-sources.test.js

@@ -0,0 +1,228 @@
+/**
+ * @fileoverview Unit tests for `sklx audit sources` CLI command.
+ * @see SMI-5407: Skill Source Provenance Recovery
+ *
+ * Tests the action layer (`runAuditSources`) with injected mocks so the test
+ * suite runs fully offline without a real DB or skills directory.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import * as os from 'node:os';
+import * as path from 'node:path';
+// ============================================================================
+// Module mocks — must be declared before the imports that use them
+// ============================================================================
+const mockOpenCliDatabase = vi.fn();
+vi.mock('../utils/open-database.js', () => ({
+    openCliDatabase: (...args) => mockOpenCliDatabase(...args),
+}));
+const mockLoadManifest = vi.fn();
+vi.mock('../utils/manifest.js', () => ({
+    loadManifest: () => mockLoadManifest(),
+}));
+const mockRecoverSources = vi.fn();
+const mockBackfillManifest = vi.fn();
+vi.mock('@skillsmith/core', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        // Must be a regular function (not arrow) so `new SourceRecoveryService()` works.
+        SourceRecoveryService: function MockSourceRecoveryService() {
+            return { recoverSources: (...args) => mockRecoverSources(...args) };
+        },
+        backfillManifest: (...args) => mockBackfillManifest(...args),
+        defaultSkillsRoot: () => path.join(os.homedir(), '.claude', 'skills'),
+    };
+});
+// ============================================================================
+// Import after mocks
+// ============================================================================
+import { runAuditSources } from './audit-sources.action.js';
+function makeReport(overrides = {}) {
+    return {
+        skills: [
+            {
+                skillName: 'linear',
+                installPath: '/home/user/.claude/skills/linear',
+                recoveredSource: {
+                    owner: 'williamsmith',
+                    repo: 'linear',
+                    url: 'https://github.com/williamsmith/linear',
+                },
+                registryId: 'uuid-linear',
+                method: 'git-remote',
+                confidence: 'exact',
+                candidates: [],
+                status: 'recovered',
+            },
+        ],
+        summary: { total: 1, recovered: 1, already_tracked: 0, unknown: 0, skipped_backup: 0 },
+        ...overrides,
+    };
+}
+function makeDb() {
+    return {
+        prepare: vi.fn().mockReturnValue({ all: vi.fn().mockReturnValue([]) }),
+        close: vi.fn(),
+    };
+}
+function baseOptions(overrides = {}) {
+    return {
+        skillsRoot: '/tmp/test-skills',
+        apply: false,
+        yes: false,
+        set: undefined,
+        minConfidence: 'high',
+        json: false,
+        embedding: false,
+        catalogHint: false,
+        writeFrontmatter: false,
+        forceWriteFrontmatter: false,
+        db: ':memory:',
+        ...overrides,
+    };
+}
+// ============================================================================
+// Tests
+// ============================================================================
+describe('runAuditSources', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        mockOpenCliDatabase.mockResolvedValue(makeDb());
+        mockLoadManifest.mockResolvedValue({ version: '1.0.0', installedSkills: {} });
+        mockRecoverSources.mockResolvedValue(makeReport());
+        mockBackfillManifest.mockResolvedValue({ planned: [], written: [], skipped: [] });
+    });
+    afterEach(() => {
+        vi.clearAllMocks();
+    });
+    // --------------------------------------------------------------------------
+    // --json shape + exit 0
+    // --------------------------------------------------------------------------
+    it('--json emits valid JSON with skills and summary', async () => {
+        const report = makeReport();
+        mockRecoverSources.mockResolvedValue(report);
+        const written = [];
+        vi.spyOn(process.stdout, 'write').mockImplementation((chunk) => {
+            if (typeof chunk === 'string')
+                written.push(chunk);
+            return true;
+        });
+        await runAuditSources(baseOptions({ json: true }));
+        const output = written.join('');
+        const parsed = JSON.parse(output);
+        expect(Array.isArray(parsed.skills)).toBe(true);
+        expect(parsed.summary.total).toBe(1);
+    });
+    // --------------------------------------------------------------------------
+    // Dry-run: default run does NOT write the manifest
+    // --------------------------------------------------------------------------
+    it('dry-run by default: does not call backfillManifest', async () => {
+        const logSpy = vi.spyOn(console, 'log').mockImplementation(() => { });
+        await runAuditSources(baseOptions());
+        expect(mockBackfillManifest).not.toHaveBeenCalled();
+        logSpy.mockRestore();
+    });
+    // --------------------------------------------------------------------------
+    // already_tracked overlay
+    // --------------------------------------------------------------------------
+    it('overlays already_tracked when manifest already has a source', async () => {
+        mockLoadManifest.mockResolvedValue({
+            version: '1.0.0',
+            installedSkills: {
+                linear: {
+                    id: 'uuid-linear',
+                    name: 'linear',
+                    version: '1.0.0',
+                    source: 'https://github.com/williamsmith/linear',
+                    installPath: '/home/user/.claude/skills/linear',
+                    installedAt: '2024-01-01T00:00:00.000Z',
+                    lastUpdated: '2024-01-01T00:00:00.000Z',
+                },
+            },
+        });
+        const jsonChunks = [];
+        vi.spyOn(process.stdout, 'write').mockImplementation((chunk) => {
+            if (typeof chunk === 'string')
+                jsonChunks.push(chunk);
+            return true;
+        });
+        await runAuditSources(baseOptions({ json: true }));
+        const parsed = JSON.parse(jsonChunks.join(''));
+        const alreadyTracked = parsed.skills.find((s) => s.status === 'already_tracked');
+        expect(alreadyTracked).toBeDefined();
+        expect(parsed.summary.already_tracked).toBe(1);
+    });
+    // --------------------------------------------------------------------------
+    // --apply --yes writes the manifest
+    // --------------------------------------------------------------------------
+    it('--apply --yes calls backfillManifest with apply: true', async () => {
+        mockBackfillManifest.mockResolvedValue({ planned: [], written: ['linear'], skipped: [] });
+        const logSpy = vi.spyOn(console, 'log').mockImplementation(() => { });
+        await runAuditSources(baseOptions({ apply: true, yes: true }));
+        expect(mockBackfillManifest).toHaveBeenCalledWith(expect.objectContaining({ summary: expect.any(Object) }), expect.objectContaining({ apply: true }));
+        logSpy.mockRestore();
+    });
+    // --------------------------------------------------------------------------
+    // Multi-candidate row appears in JSON output
+    // --------------------------------------------------------------------------
+    it('--json includes candidates array when ambiguous (multi-match)', async () => {
+        const ambiguousReport = makeReport({
+            skills: [
+                {
+                    skillName: 'git-helper',
+                    installPath: '/home/user/.claude/skills/git-helper',
+                    recoveredSource: null,
+                    registryId: null,
+                    method: 'registry-name',
+                    confidence: 'low',
+                    candidates: [
+                        {
+                            id: 'id-1',
+                            name: 'git-helper',
+                            owner: 'alice',
+                            repo: 'git-helper',
+                            url: 'https://github.com/alice/git-helper',
+                            qualityScore: 80,
+                        },
+                        {
+                            id: 'id-2',
+                            name: 'git-helper',
+                            owner: 'bob',
+                            repo: 'git-helper',
+                            url: 'https://github.com/bob/git-helper',
+                            qualityScore: 60,
+                        },
+                    ],
+                    status: 'unknown',
+                },
+            ],
+            summary: { total: 1, recovered: 0, already_tracked: 0, unknown: 1, skipped_backup: 0 },
+        });
+        mockRecoverSources.mockResolvedValue(ambiguousReport);
+        const written = [];
+        vi.spyOn(process.stdout, 'write').mockImplementation((chunk) => {
+            if (typeof chunk === 'string')
+                written.push(chunk);
+            return true;
+        });
+        await runAuditSources(baseOptions({ json: true }));
+        const parsed = JSON.parse(written.join(''));
+        expect(parsed.skills[0]?.candidates).toHaveLength(2);
+    });
+    // --------------------------------------------------------------------------
+    // --write-frontmatter without --force-write-frontmatter exits non-zero
+    // --------------------------------------------------------------------------
+    it('--write-frontmatter without --force-write-frontmatter exits with code 1', async () => {
+        const exitSpy = vi
+            .spyOn(process, 'exit')
+            .mockImplementation((_code) => {
+            throw new Error('process.exit');
+        });
+        const errSpy = vi.spyOn(console, 'error').mockImplementation(() => { });
+        await expect(runAuditSources(baseOptions({ writeFrontmatter: true, forceWriteFrontmatter: false }))).rejects.toThrow('process.exit');
+        expect(exitSpy).toHaveBeenCalledWith(1);
+        exitSpy.mockRestore();
+        errSpy.mockRestore();
+    });
+});
+//# sourceMappingURL=audit-sources.test.js.map